EP3550623B1 - Puf-film und verfahren zur herstellung davon - Google Patents

Puf-film und verfahren zur herstellung davon Download PDF

Info

Publication number
EP3550623B1
EP3550623B1 EP18166138.0A EP18166138A EP3550623B1 EP 3550623 B1 EP3550623 B1 EP 3550623B1 EP 18166138 A EP18166138 A EP 18166138A EP 3550623 B1 EP3550623 B1 EP 3550623B1
Authority
EP
European Patent Office
Prior art keywords
electrode layer
structured electrode
puf
layer
region
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP18166138.0A
Other languages
English (en)
French (fr)
Other versions
EP3550623A1 (de
Inventor
Martin KÖNIG
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fraunhofer Gesellschaft zur Forderung der Angewandten Forschung eV
Original Assignee
Fraunhofer Gesellschaft zur Forderung der Angewandten Forschung eV
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fraunhofer Gesellschaft zur Forderung der Angewandten Forschung eV filed Critical Fraunhofer Gesellschaft zur Forderung der Angewandten Forschung eV
Priority to EP18166138.0A priority Critical patent/EP3550623B1/de
Priority to US16/375,081 priority patent/US11411748B2/en
Publication of EP3550623A1 publication Critical patent/EP3550623A1/de
Application granted granted Critical
Publication of EP3550623B1 publication Critical patent/EP3550623B1/de
Priority to US17/816,315 priority patent/US11889004B2/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • H04L9/3278—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response using physically unclonable functions [PUF]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
    • G06F21/75—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information by inhibiting the analysis of circuitry or operation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/86—Secure or tamper-resistant housings
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01L—SEMICONDUCTOR DEVICES NOT COVERED BY CLASS H10
    • H01L21/00—Processes or apparatus adapted for the manufacture or treatment of semiconductor or solid state devices or of parts thereof
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01L—SEMICONDUCTOR DEVICES NOT COVERED BY CLASS H10
    • H01L23/00—Details of semiconductor or other solid state devices
    • H01L23/57—Protection from inspection, reverse engineering or tampering
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01L—SEMICONDUCTOR DEVICES NOT COVERED BY CLASS H10
    • H01L23/00—Details of semiconductor or other solid state devices
    • H01L23/57—Protection from inspection, reverse engineering or tampering
    • H01L23/573—Protection from inspection, reverse engineering or tampering using passive means
    • H—ELECTRICITY
    • H01—ELECTRIC ELEMENTS
    • H01L—SEMICONDUCTOR DEVICES NOT COVERED BY CLASS H10
    • H01L28/00—Passive two-terminal components without a potential-jump or surface barrier for integrated circuits; Details thereof; Multistep manufacturing processes therefor
    • H01L28/40—Capacitors
    • H01L28/60—Electrodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry

Definitions

  • the present invention relates to PUF-films and to a method for producing the same.
  • the present invention further relates to a method for producing a capacitive foil array using a dielectric layer effecting a capacitive variation and, at the same time, enables a via-free foil architecture.
  • the present invention further relates to a circuit concept for monitoring a protective housing on a basis of a capacitive PUF-structure with a further possibility for integrity checks.
  • the present invention further relates to a concept for a protective housing on a basis of a capacitive PUF-structure with a possibility for integrity checks including an optional embedding of a security sensor and layout randomization.
  • Security enclosures that are permanently monitored for penetration and tampering are common solutions for providing physical integrity to multiple-chip embedded systems. While known concepts employ battery-backed key-storage and continuous sensing, recent battery-less technologies use enclosures evaluated as Physical Unclonable Functions (PUF).
  • PPF Physical Unclonable Functions
  • HSM Hardware Security Modules
  • PCI-HSM Physical Security Modules
  • the first system verifies the integrity of the enclosure by detecting open and short circuits. This may also be referred to as tamper-sensitive.
  • the battery-backed system is always (i.e., during storage and transport) in operation.
  • tamper-evident PUF-based enclosures provide inherent security without a battery.
  • These battery-less technologies are based on the repeatable generation of a system-individual cryptographic key from the enclosure's unique physical properties. The key encrypts either the critical security parameters or the entire system. As any intrusion destroys parts of the enclosure, the cryptographic key is permanently lost and the HSM's data cannot be decrypted by the adversary after intrusion.
  • the resistance-based Gore-envelope [2] system is one example for an integrity-only solution. It verifies the enclosure's integrity but does not provide PUF readout. Since its integrity verification method is based on a Wheatstone bridge, it can hardly be integrated into a PUF measurement system as both methods would interfere with each other.
  • Another tamper detection system is the fringe-effect proximity sensor enclosure [3].
  • capacitive sensing for detecting intruding objects, it cannot extract capacitive PUF properties.
  • One example is the Coating-PUF [4] that protects a single-chip system using capacitive sensors integrated into the coated silicon chip.
  • this circuit concept can extract PUF properties, it is not compatible with a large-scale enclosure and also does not support integrity verification. Similar issues are observed for the BoardPUF [5] which uses a capacitive PUF, implemented in the printed circuit board (PCB) but has no means for integrity verification.
  • PCB printed circuit board
  • Resistance-based concepts require a conductor to be damaged so as to detect an attack.
  • Such secure communication relies on electronic systems that guarantee the integrity and confidentiality of the data. This is enforced by security standards such as FIPS 140-2, PCI-HSM or certain protection profiles of Common Criteria (CC).
  • Compliant devices are required to implement physical security countermeasures to prevent unauthorized access to Critical Security Parameters (CSPs), such as cryptographic keys. Hence, they must withstand a wide range of invasive, semi-invasive, and non-invasive attacks to make successful attacks improbable [6], [7].
  • PCBs Printed Circuit Boards
  • the current approach is based on an envelope with a mesh that wraps around the Module Under Protection (MUP) [2]. Attempts to penetrate the mesh are very likely to destroy its tracks and result in open circuits. A continuous measurement from inside the system detects these open circuits and triggers an alarm that causes the zeroization of CSPs (i.e., tamper-detection and response).
  • CSPs i.e., tamper-detection and response.
  • BBRAM Battery-Backed Random-Access Memory
  • PUFs are implemented in Integrated Circuits (IC), it is impossible to use them for aftermarket protection of Commercial-Off-The-Shelf (COTS) components.
  • COTS Commercial-Off-The-Shelf
  • silicon based PUFs typically do not have the property of tamper-evidence [11]. I.e., once powered on, they cannot verify if an attack was executed on the system while powered off. Even worse, they are incapable of detecting online attacks that extract values during runtime [12].
  • WO 2010/076733 A1 shows a method for producing a PUF film by forming a layer of dielectric material by vapour deposition.
  • EP 2 230 794 A shows an implementation of a PUF as a cross bar memory with nanowires formed by nanoimprinting.
  • the inventors have found that printing a dielectric material using printing process, a variation in a thickness of the dielectric material may be obtained and that such a variation influences an electric measurement value. Based on the randomness of the variation due to the printing process such an architecture is suitable as PUF-film.
  • a method for producing a PUF-film comprises printing a layer of dielectric material on a film substrate, such that a variable thickness of the layer is obtained by the printing.
  • the method comprises arranging a structured electrode layer on the dielectric material.
  • the method is executed such that the structured electrode layer is influenced with respect to an electric measurement value due to the variable thickness.
  • the electric measurement value comprises one of an electric capacitance value, an electric impedance value, an electric resistance value and an electric inductance value.
  • the method is thus suitable for single, differential measurement of electrical values or combinations thereof.
  • the printing of the layer of dielectric material is carried out such that a relative position of a surface profile of the dielectric layer with respect to the structured electrode layer underlies a stochastic distribution. This allows for a randomness between different PUF-films being produced by the method.
  • the dielectric material comprises at least one granule material, wherein the granule material comprises a different dielectric constant when compared to the dielectric material.
  • the structured electrode layer is a first structured electrode layer.
  • a second structured electrode layer is arranged at the film substrate.
  • the dielectric material is printed onto the second structured electrode layer, such that the dielectric material covers the second structured electrode layer in a first region and does not cover the second structured electrode layer in a second region, such that a material edge of the dielectric material extends between the first region and the second region.
  • the first structured electrode layer is arranged in the first region and in the second region such that the first structured electrode layer extends over the material edge and such that the first structured electrode layer is spaced from the second structured electrode layer in the first region by the dielectric material and is galvanically connected to the second structured electrode layer or arranged in a common plane with the second structured electrode layer in the second region.
  • the second region is enclosed by the first region or is adjacent to the first region and forms an edge region of the first region. This allows for simple implementation of layouts of the PUF-film.
  • the first structured electrode layer and the second structured electrode layer are arranged such that the first structured electrode layer and the second structured electrode layer are connectable in a common connector layer.
  • lines of the structured electrode layers may be arranged in a common plane and/or towards a common connector and therefore simplifying a later connection of the PUF-film.
  • the structured electrode layer is a first structured electrode layer, wherein the film substrate comprises a second structured electrode layer having a plurality of second conductive traces, wherein the dielectric material is printed onto the second structured electrode layer.
  • the first structured electrode layer is arranged such that the first structured electrode layer comprises a plurality of first conductive traces overlapping with the second conductive traces in a plurality of overlapping regions so as to form capacitive elements in the overlapping regions. This allows for reliably generating PUF functionalities such as capacitances by forming them with conductive traces so as to generate a comparable function when compared to dedicated capacitive elements such as capacitors.
  • the printing of the dielectric material is implemented as additive process.
  • Additive processes allow for reliable PUF-films produced therewith because dirt or the like generated by subtractive processes may be avoided.
  • the printing of the dielectric material comprises execution of a silkscreen process, a rotary printing process, an offset printing process, a pad printing process and a spin coating process.
  • Those processes are executable with a high precision and thus allow for PUF-films with a high quality.
  • the dielectric material is a photosensitive material.
  • the method comprises exposing the photosensitive material in an exposure region so as to develop the dielectric material in the exposing region and so as to define a mask of the dielectric material. This allows for precisely defining regions in which the dielectric material is arranged. Photosensitive materials may allow for a higher resolution when compared to printing processes and thus for increasing a precision of structures.
  • the method further comprises arranging an electric shield at the PUF-film, e.g., at the substrate, so as to shield the structured electrode layer. This allows for a precise detection of the electric measurement value.
  • a PUF-film comprises a layer stack, the layer stack having a film substrate, a printed dielectric layer having a varying layer thickness in the dielectric material and a structured electrode layer being arranged at the dielectric layer.
  • the structured electrode layer is influenced with respect to an electric measurement value due to the variable thickness.
  • the restructured electrode layer is a first structured electrode layer.
  • the film substrate comprises a second structured electrode layer having a plurality of second conductive traces.
  • the dielectric material is printed onto the second structured electrode layer.
  • the first structured electrode layer is arranged such that the first structured electrode layer comprises a plurality of first conductive traces overlapping with the second conductive traces in a plurality of overlapping regions so as to form capacitive elements in the overlapping regions.
  • the electric capacitance values of the capacitive elements varies stochastically based on the variation of the thickness of the dielectric layer due to the printing of the dielectric material. This allows for PUF-films providing for a high security.
  • the inventors have found that by using a circuit structure with a plurality of circuit elements having electric resistance values and having electric capacitance values between the circuit elements, by exploiting both, the electric capacitance values and the electric resistance values, a reliable and robust device protection may be obtained because the capacitance values may be used as PUFs, wherein the electric resistance values may be used for integrity checks, i.e., for determining proper operation of the protecting device itself.
  • a PUF-film comprises a circuit structure having a plurality of circuit elements, wherein the circuit structure is evaluable with respect to a plurality of electric capacitance values being arranged between the plurality of circuit elements.
  • the circuit structure is further evaluable with respect to a plurality of electric resistance values of the plurality of circuit components.
  • the circuit structure comprises a first multitude of conducting traces being arranged in a first trace layer of the PUF-film, and comprises a second multitude of conducting traces being arranged in a second trace layer of the PUF-film.
  • the first multitude of conducting traces and the second multitude of conducting traces overlaps in a plurality of overlap regions in which first multitude of conductive traces is separated from the second multitude of conductive traces by a dielectric so as to form a corresponding plurality of capacitor structures in the overlap regions, wherein each electric capacitance value of the circuit structure is based on at least a first and a second capacitor structure.
  • each trace overlaps at least a first and a second time with other traces.
  • the plurality of electric resistance values is arranged between ends of the circuit elements, i.e., the conductive traces. This allows for simple structures to be used, namely the conductive traces, wherein robustness and reliability is obtained by the layout of the conductive traces so as to overlap with each other.
  • the plurality of conducting traces is meandered and covers a first film region.
  • the second plurality of conducting traces is meandered and covers a second film region.
  • the first film region and second film region overlap with each other. This allows for a high density of conductive traces in a sensor region being defined by the overlap of the first film region and the second film region.
  • the plurality of circuit elements comprises a plurality of conductive traces, wherein each conductive trace of the plurality of conductive traces comprises a first section and a second section being spaced from the first section.
  • the first section and the second section are accessible for a measurement of an electric resistance value of the conductive trace between the first section and the second section.
  • the PUF-film has a dielectric material being arranged between the plurality of circuit elements.
  • the dielectric material comprises a granule material which is arranged in a stochastic distribution in the dielectric material so as to influence the plurality of electric capacitance values. This allows for a randomization of capacitance values between different PUF-films and further allows for a high robustness. Invasive attacks such as a drilling attack removes parts of the dielectric material and thus the granule material. Repairing such a damage is hampered because also knowledge about the granule material, i.e., size, density and/position of a granule or pellet is required for a proper repair.
  • the PUF-film comprises a layered structure in which a dielectric foil substrate is arranged between a first trace layer and a second trace layer so as to form the plurality of electrical capacitance values in overlapping regions of the first and second trace layer.
  • One or both of the first and second trace layer is at least covered with a printed dielectric material which allows for a high entropy of the architecture.
  • an apparatus comprises a PUF-film and an evaluation unit configured for differentially evaluating the electric capacitance values so as to obtain a first evaluation result.
  • the evaluation unit is further configured for evaluating the plurality of electric resistance values so as to obtain a second evaluation result. This allows for an apparatus configured for monitoring the functionality and/or integrity of the PUF-film.
  • the evaluation unit is configured for evaluating an electric capacitance values of the plurality of electric capacitance values between a first circuit element and a second circuit element of the plurality of circuit elements for differentially evaluating the electric capacitance value of the first and second circuit element. This allows for a concrete information of the condition of the PUF-film as a mutual condition between the circuit elements is monitored.
  • the plurality of circuit elements comprises at least a first conductive trace, a second conductive trace and a third conductive trace, wherein the first conductive trace overlaps with the third conductive trace and wherein the second conductive trace overlaps with the third conductive trace.
  • a first electric capacitance value is present between the first conductive trace and the third conductive trace, in particular, at a region where both conductive traces overlap.
  • a second electric capacitance value is arranged between the second conductive trace and the third conductive trace, in particular, in a region where the traces overlap.
  • the evaluation unit is configured for applying a first excitation signal to the first conductive trace and to simultaneously apply a second excitation signal to the second conductive trace.
  • the evaluation unit is configured for receiving a response signal from the third conductive trace so as to differentially evaluate a first electric capacitance value between the first conductive trace and the third conductive trace and second electric capacitance value between the second conductive trace and the third conductive trace. This allows for a high amount of information because a signal to be applied to one or more specific traces and a trace to be selected for receiving a signal from it may be varied which may lead to different results containing information.
  • the evaluation unit configured for providing the second excitation signal so as to be in antiphase with respect to the first excitation signal. This allows for cancelling out the absolute capacitances between the first and third as well as between the second conductive trace and the third conductive trace to obtain only the difference in their capacitance accurately.
  • the differentially evaluated electric capacitance value is a differential electric capacitance value such as previously mentioned.
  • the first conductive trace and the second conductive trace comprise absolute electric capacitance values with respect to a reference electrode.
  • the differential electric capacitance value is smaller by a factor of at least 100 (i.e., at most 0.01) when compared to the absolute electric capacitance value.
  • the evaluation unit is configured for evaluating changes in the differential electric capacitance value being smaller by a factor of at least 20 when compared to the differential electric capacitance value. This allows for evaluating even minor changes in the PUF-film.
  • the evaluation unit is configured for compensating measurement errors in the first evaluation result and/or in the second evaluation result for an environmental parameter.
  • the compensation may be performed by use of additional information such as temperature and/or by use of absolute values of the capacitance for compensating the differential measurement. This allows for further enhancing the results by avoiding errors due to the environmental parameter and thus allows for a high robustness.
  • the evaluation unit is further configured for evaluating an absolute electric capacitance value between a pair of traces of the circuit structure at a first instance of time and for evaluating the absolute electric capacitance value between the pair of traces at a second instance of time, wherein the evaluation unit is configured for comparing the absolute capacitance value evaluated at the first instance of time and at a second instance of time so as to obtain an absolute capacitance evaluation result and to compensate the first evaluation result for an environmental effect using the absolute capacitance evaluation result.
  • the plurality of circuit elements is a plurality of conductive traces.
  • the evaluation unit is configured for obtaining the second evaluation result based on an evaluation of the electric resistance value of the plurality of conductive traces. This allows for a simple integrity check, in particular in view of open circuits or short circuits between traces.
  • the evaluation unit is configured for determining an attack of the PUF-film based on the first evaluation result and the second evaluation result. By combining both information, a robust determination of the condition of the PUF-film may be obtained.
  • the evaluation unit is configured for determining a first cryptographic key based on the plurality of electric capacitance values at a first instance of time.
  • the evaluation unit is configured for encrypting data for operating the apparatus using the first cryptographic key so as to obtain encrypted data, and for storing the encrypted data.
  • the evaluation unit is configured for deleting the first cryptographic key, e.g., by actively or passively resetting memory cells.
  • the evaluation unit is configured for determining a second cryptographic key based on the plurality of electric capacitance values at a second instance of time and for reading the encrypted data and decrypting the encrypted data using the second cryptographic key. This allows for a battery-less implementation of a PUF-based security module.
  • the evaluation unit is configured for deleting data or for deactivating a function of the device in case of detecting altering of the circuit structure or the PUF-film.
  • the evaluation unit comprises a transimpedance amplifier being configured for providing a voltage signal based on a current signal received from a circuit element. This allows for evaluating a received current whilst maintaining a precision of processing voltage signals.
  • the inventors have found that by combining a capacitive measurement of a PUF with an electric shield, reliable measurements may be performed resulting in reliable measurement data which are even robust in harsh environments such as an environment in which the device is exposed to interference such as strong electric fields.
  • a PUF-film comprises a flat circuit structure comprising a plurality of circuit elements.
  • the PUF-film comprises a flat electric shield, wherein the circuit structure is evaluable with respect to a plurality of electric capacitance values being arranged between the plurality of circuit elements.
  • the electric shield at least partially covers the circuit structure and provides a common reference electrode for the plurality of electric capacitance values.
  • the electric shield may act as an electrode and may thus influence the capacitance of capacitive elements, wherein said influence may be common for all of the shielded capacitive elements. This allows for robust measurements.
  • the electric shield is formed by a metallic mesh or a sprayed conductive layer. This allows for shielding topographic devices having edges or the like. Alternatively or in addition, this allows for bending or wrapping the PUF-film around a housing whilst obtaining or maintaining the shielding effect.
  • the circuit elements are covered at least partially with an at least partially opaque material being adapted in view of a transmission or absorption in a visible wavelength range and/or in an x-ray wavelength range.
  • the material may be opaque but may also comprise a within a tolerance range of 10 % a same absorption coefficient when compared to the conductive traces at least in the relevant optical regions such as X-ray or optical wavelength. This allows for further protection as avoiding an inspection by sight, i.e., by optically analyzing circuit structures or the like.
  • an opaque material may optionally be non-conductive, such a material may preferably be combined with a shield being formed by a metallic mesh or being a sprayed conductive layer such that such a material may be covered with the electric shield although being non-conductive or semi-conductive.
  • a conductive material may be used, for example, a silver paste or the like. Silver paste may allow for an opaqueness but may be formed conductive based on the degree of filling of the silver in the paste.
  • the opaque material may comprise PEDOT/PSS, inks comprising carbon nanotubes or the like as well as thin metal layers.
  • the plurality of circuit elements comprises a multitude of conductive traces, wherein the PUF-film is evaluable with respect to an electric capacitance value between a first conductive trace and a second conductive trace.
  • the PUF-film comprises a capacitive element being galvanically connected to the first conductive trace and the second conductive trace, wherein both ends of each trace are accessible by the evaluation unit.
  • the PUF-film comprises a layer stack in which a first electric shield layer, a first substrate layer, a first trace layer comprising a first part of the plurality of circuit elements, a first dielectric layer, a second trace layer comprising a second part of the plurality of circuit elements, a second dielectric layer and a second shield layer are arranged in this order.
  • the circuit elements may be sandwiched between two shield layers providing for the electric shield such that a shielded PUF-film may be obtained.
  • the first dielectric layer and/or the second dielectric layer comprises a granule material being arranged in a stochastic distribution so as to influence the plurality of electric capacitance values.
  • the granule material allows for a high degree of protection because of hampering repairing the PUF-film.
  • the first dielectric layer partially covers the first trace layer such that the conductive traces of the first trace layer are uncovered from the first dielectric layer in a contact region.
  • Conductive traces of the second trace layer extend beyond an edge of the dielectric layer into the contact region and are arranged in a layer of the conductive traces of the first trace layer in the contact region.
  • the plurality of circuit elements comprises a plurality of conductive traces, wherein first conductive traces of the plurality of conductive traces are arranged in a first trace layer and wherein second conductive traces of the plurality of conductive traces are present in a second trace layer.
  • An electric capacitance value is at least partially arranged in an overlap area in which one of the first conductive traces overlaps with one of the second conductive traces. This allows for generating capacitive structures using conductive traces which may be arranged or generated in a simple manner.
  • the plurality of circuit elements comprises a plurality of conductive traces being arranged in at least a first trace layer and a second trace layer, wherein conductive traces arranged in the first layer and conductive traces arranged in the second layer are arranged in an interleaved manner such that a conductive trace is exclusively neighbored by a different conductive trace along an axial course of the trace.
  • the plurality of circuit elements comprises a first plurality of conductive traces arranged in a first trace layer and a second plurality of conductive traces arranged in a second layer.
  • the PUF-film comprises an interconnecting circuit being configured for providing a configurable, e.g., a factory-configurable connection within the first plurality of conductive traces and/or within the second plurality of conductive traces. This allows for utilizing a high number of conductive traces by a low number of control interfaces, i.e., traces to be controlled by a controlling unit.
  • the plurality of circuit elements is evaluable with respect to a plurality of electric capacitance values and a plurality of electric resistance values. This allows for a further increase of robustness and reliability.
  • an apparatus comprises a PUF-film and an evaluation unit configured for differentially evaluating the plurality of electric capacitance values based on an antiphasic excitation of neighbored circuit elements. The antiphasic excitation of neighbored circuit elements allows for a compensation of absolute capacitive effects.
  • the evaluation unit is configured for antiphasically exciting a first circuit element and a second circuit element of the plurality of circuit elements at an instance of time and for not exciting a third, i.e., da different circuit element of the plurality of circuit elements at the instance of time.
  • a third i.e., da different circuit element of the plurality of circuit elements at the instance of time.
  • the apparatus comprises a housing.
  • the PUF-film comprises a sensor region being formed by an overlap region of first circuit elements in a first trace layer and second circuit elements in a second trace layer.
  • the housing is completely covered by the sensor region. This allows for a high security of the apparatus.
  • the PUF-film comprises a carbon material at least partially covering the circuit elements, wherein the PUF-film is covered with an electric shield comprising a metallic mesh or a sprayed conductive layer.
  • the carbon material may comprise a same or within a tolerance range of 10 % same absorption coefficient when compared to the conductive traces and/or the shield at least in the relevant optical regions such as X-ray and/or visible wavelength.
  • the carbon material may optionally allow for at least a degree of opaqueness in the visible wavelength range and the x-ray wavelength range.
  • the low conductive property may be at least partially compensated with the electric shield so as to maintain the preciseness of the measurements.
  • PUFs Physically Unclonable Functions
  • PUFs are understood as electrically evaluable parameters such as resistances, complex impedances, capacitances, inductances and/or impedances being suitable, as a single parameter or as a combination of parameters, e.g., as a pattern, for identifying the device carrying the PUFs and/or for evaluating, monitoring/surveying the intactness or integrity of the device.
  • a PUF-film may also be understood as PUF-foil, i.e., as a comparatively thin structure along a thickness direction (z) when compared to dimensions of the structure along other possibly lateral or axial directions such as a length and/or a width, simply directions x and y.
  • PUF-film does not necessarily imply that the film is repeatedly foldable or bendable.
  • a PUF-film may comprise a metallic substrate and/or a semiconductor substrate having a high stiffness and/or not being configured to be bendable.
  • embodiments also refer to PUF-films being rigid structures.
  • Fig. 1 shows a schematic flowchart of a method 1000 according to an embodiment of the first aspect.
  • Method 1000 comprises a step 1010 in which a layer of dielectric material is printed on a film substrate such that a variable thickness of the layer is obtained by the printing.
  • the film substrate may comprise one or more layers of insulating or dielectric material such as a plastic material, a glass material or the like.
  • the film substrate may be understood as a substrate for receiving the dielectric material. It is thus possible but not required that the film substrate exclusively comprises insulating materials.
  • the film substrate may comprise conductive materials and/or structures such as circuit structures, e.g., conductive traces and/or circuit elements. Alternatively or in addition, such structures may be arranged on or at the film substrate prior to printing the layer of dielectric material in the step 1010. Alternatively or additionally, the film substrate may exclusively comprise insulating materials.
  • the printing 1010 may be implemented as an additive process in which materials are added onto the film substrate. Although it is also possible to use subtractive processes comprising depositing the dielectric material and then removing parts of the material, e.g., using laser oblation, additive processes provide for the advantage that contaminations caused by subtractive processes may be avoided.
  • the printing 1010 may be performed, for example, by a silkscreen process, a rotary printing process, an offset printing process, a pad printing process and/or a spin coating process.
  • a silkscreen process which is suitable for implementing the method 1000 as a real-to-real process allowing for a high productivity and a high repeatability.
  • the step 1010 may be combined with a photolithographic process in which the printed dielectric material may be exposed to an exposing radiation such as ultraviolet radiation so as to define regions of the dielectric material to be removed and/or retained.
  • the photolithographic process may allow for obtaining a higher resolution when compared to a resolution of the process for generating/printing the dielectric layer.
  • the printing 1010 may be combined with further processes.
  • a further variation in the thickness of the dielectric layer and thus of the respective electric property may be obtained by subtractive processes such as laser ablation. This does not require reducing a thickness of the complete layer.
  • lines or patterns, e.g., checkerboard-patterns or the like may be generated in the dielectric layer 28 so as to enable a variation of the layer thickness in some regions so as to amplify the variation of the capacitance value.
  • block-copolymer materials may be used as a dielectric material. Such materials may comprise two faces which continue to exist after drying or curing. Although a dielectric constant of the material may vary between both faces, such variation may vary across all of the capacitance values and therefore allow for maintaining same relative or differential values.
  • the dielectric material may be printed, for example, as a paste or a fluid having a high viscosity.
  • the dielectric material may comprise particles, for example, ceramic particles which may be varied with respect to their size and/or a degree of filling they provide in the dielectric material. For example, for obtaining different thicknesses of the dielectric material on the film substrate, different viscosities and/or different degrees of filling and/or different sizes of the ceramic particles may be used.
  • the particles contained in the dielectric material may provide for a topography on the surface of the dielectric layer.
  • An example diameter of ceramic particles may be at least 0.5 ⁇ m and at most 10 ⁇ m, at least 1 ⁇ m and at most 5 ⁇ m and at least 1.5 ⁇ m and at most 5 ⁇ m, e.g., 2 ⁇ m or any other suitable value.
  • the particles may exceed or protrude from the (plane) surface of the dielectric material with e.g., 1/4 of their diameter, i.e., approximately 500 nm. Although protruding from the virtual plane surface, the particles may still be covered by a thin layer of a dielectric material or paste.
  • the paste may be or may comprise, for example, a polymer matrix for linking the particles.
  • a variation within the topography between wave crests and wave throughs may be at least 100 nm, at least 300 nm or at least 400 nm, e.g., 500 nm or even more.
  • a variable thickness of the dielectric layer may be obtained.
  • the printed material itself may provide for a variable thickness.
  • the topography of the film substrate may provide for a variation within the thickness of the dielectric layer, e.g., when performing the process so as to generate a (approximated) plane surface on a rough or uneven film substrate.
  • electrodes of the film substrate may comprise a roughness of approximately 500 nm, e.g., in a worst case, which may influence or even add up in the total variation of the thickness.
  • the printing process itself may be used.
  • small dots or small towers of dielectric material may be arranged one beside the other. Based, influenced or even depending on the thixotropy or viscosity, the dots or towers combine or meld with each other. This process may allow for obtaining a remaining variation in the topography and therefore a further variation within the thickness.
  • a total variation of the thickness of the layer may comprise a value of, for example, at least 200 nm and at most 10 ⁇ m, at least 500 nm and at most 8 ⁇ m or at least 700 nm and at most 5 ⁇ m, e.g., in a range between 1 ⁇ m and 3 ⁇ m.
  • the method 1000 comprises a step 1020 in which a structured electrode layer is arranged on the dielectric material such that the structured electrode layer is influenced with respect to an electric measurement value due to the variable thickness of the dielectric layer.
  • the electric measurement value may comprise at least one of an electric capacitance value, an electric impedance value, an electric resistance value and an electric inductance value. Combinations thereof lie within the embodiments of the present invention.
  • electric capacitance values as the dielectric material may be arranged between a structured electrode layer arranged on the film substrate and the structured electrode layer arranged on the dielectric material allowing a formation of capacitive elements.
  • opposing electrodes may further allow for a variation in electric resistance values, electric impedance values or electric inductance values, depending on the dielectric material.
  • the dielectric material may also comprise conductive and/or inductive materials.
  • the variation of the thickness of the dielectric layer in combination with variances achieved by the printing process allow for a randomization of the thickness and therefore for a randomization of the electric measurement value.
  • This measurement value may this be used as a Physical Unclonable Function (PUF).
  • PEF Physical Unclonable Function
  • Arranging the structured electrode layer on the dielectric layer 28 and/or arranging conductive traces on the film substrate 24 may comprise a deposition process, a printing process and/or a photolithographic process.
  • a printing process may allow for a simple and repeatable deposition, wherein a photolithographic process may allow for a high resolution or precision.
  • method 1000 enables producing a capacitive foil array having the property that capacitances vary with respect to their electric values.
  • the capacitive array can be used for generating a cryptographic key which is derived from the variations of the capacitive values.
  • the capacitive array is formed by lines and columns being separated from each other by a dielectric.
  • Fig. 2 shows as schematic side view of a PUF-film 20 according to an embodiment of the first aspect.
  • the PUF-film comprises a layer stack 22 comprising a plurality of layers.
  • the layer stack 22 comprises a film substrate 24.
  • the layer stack 22 further comprises conductive traces 26 1 to 26 7 , e.g., forming a first conductive structure, or circuit structure.
  • the conductive traces 26 1 to 26 7 may be part of the film substrate 24 and/or may be arranged thereon as a separate layer or structure.
  • the dielectric material may be printed onto the film substrate 24 including or excluding the conductive traces 26 1 to 26 7 .
  • the layer stack 22 comprises a printed dielectric layer 28 which may be printed, for example, during the step 1010.
  • the printing may be performed in one step or in a multitude or plurality of steps so as to reduce or prevent pin-holes.
  • Different layers may comprise, for example, different granule materials.
  • the layer stack 22 further comprises a structured electrode layer 32 being arranged at the dielectric layer 28 such that the dielectric layer 28 is arranged at least between parts of the circuit structure comprising the conductive traces 26 1 to 26 7 and the structured electrode layer 32. Between conductive traces 26 and the structured electrode layer 32, an electric property 34 may be obtained.
  • the type of the electric property 34 may be based or may depend on properties of the dielectric material arranged in the dielectric layer 28 and/or an interconnection of parts of the structured electrode layer 32 and/or of the conductive traces 26 1 to 26 7 .
  • the PUF-film 20 is described as forming electric capacitance values as electric properties 34 1 to 34 5, also further or different electric properties such as impedance values and/or resistance values and/or inductance values may be obtained.
  • the dielectric layer 28 may comprise a varying and/or different thickness d 1 to d 5 at locations where conductive traces 26 2 to 26 6 oppose the structured electrode layer 32 so as to form the electric capacitance values 34 1 to 34 5 .
  • the thickness may be understood as an extension along a direction being parallel to a surface normal 38 of the film substrate 24. Based on the varying thickness, i.e., differences between thickness d 1 , d 2 , d 3 , d 4 and/or d 5 , varying electric capacitance values 34 1 , 34 2 , 34 3 , 34 4 and/or 34 5 may be obtained.
  • the number of conductive traces 26 being 7 in Fig. 2 is exemplary only. Any other number of conductive traces 26 may be implemented, e.g., 0 or more, 1 or more, 2 or more, e.g., 4, 5, 6, 10, 16 or other values. Further, one or more of the conductive traces may be galvanically coupled to each other and/or may be a part of a same and possibly folded or meandered conductive trace. Alternatively or in addition, at least one, some or all of the conductive traces may comprise a different and possibly application specific shape.
  • the structured electrode layer 32 is illustrated as one single conductive trace, also a higher number of conductive elements or traces may be implemented. Alternatively or in addition, different electronic components may be arranged, for example, capacitor elements, inductance elements such as coils or the like.
  • the surface profile of the dielectric layer 28 may be influenced, at least partially, by particles contained in the dielectric material and/or by surface profiles contained by the printing process.
  • a relative position of a surface profile of the dielectric layer 28 with respect to the structured electrode layer 32 may underlie a stochastic distribution. For example, a concrete or exact position of the particles within the dielectric material is unknown and/or a specific position of holes of a screen or filter or strainer causing variations in the topography may be unknown or at least varying.
  • the dielectric material used for printing the dielectric layer 28 may also comprise at least one granule material having a dielectric constant being different from a dielectric constant of a polymer matrix and/or the ceramic particles so as to allow for a further randomization of the electric properties 34. Furthermore, as a size, position and/or property of the granule material may vary along a lateral position and/or along a thickness direction within the dielectric material and/or may vary between different PUF-films, a further level of security may be obtained. In case of an attack such as a drilling attack leading to defects or damages in the PUF-film, a reparation is hampered because the property of the granule material would also be required to be repaired.
  • different types of granule materials may be arranged in the dielectric material 28, e.g., two types, three types, four types or even more.
  • Example materials which may be used for generating ceramic based capacitances and that may be used as a granule material include, amongst others, MgNb 2 O 3 , ZnNb 2 O 6 , MgTa 2 O 3 , ZnTa 2 O 6 , (ZnMg)TiO 3 , (ZrSn)TiO 4 and/or Ba 2 Ti 9 O 20 .
  • Further example materials include Al2O3; SiO2; Cr2O3; Si2O3; SiC, ZrO2, TiO2.
  • the granule material may comprise, for example, dielectric materials such as TiO 2 , TiN or the like.
  • the dielectric material may be printed such that the dielectric layer 28 covers a first region 42 which may be continuous or discontinuous.
  • the dielectric layer 28 may be printed so as to not cover a second region 42 of the film substrate 24 and/or the circuit structure comprising the conductive traces 26 1 to 26 7 .
  • the conductive traces 26 1 to 26 7 may form a further structured electrode layer 32 2 .
  • one or more material edges 46 1 to 46 3 may be arranged so as to separate the regions 42 and 44.
  • the structured electrode layer 32 1 may be arranged on the dielectric layer 28 so as to extend between the first region 42 and the second region 44 by extending over one or more of the material edges 46 1 to 46 3 .
  • first and second structured electrode layers 32 1 and 32 2 may be galvanically connected or coupled with each other, e.g., by a soldering process.
  • at least parts of first and second structured electrode layers 32 1 and 32 2 may be arranged in a common plane without galvanic connection with the second structured electrode layer, for example, for forming lines or pins of a connector.
  • a method for producing the PUF-film 20 may further comprise arranging an electric shield so as to shield the structured electrode layer 32 1 and/or 32 2 .
  • a shielding layer i.e., a layer of a conductive material, may be arranged on a surface of the film substrate 24 opposing the dielectric material 28.
  • the shielding may be arranged adjacent to the structured electrode layer 32 1 , for example, on a surface thereof opposing the film substrate 24.
  • An insulating and/or dielectric material may be arranged between the structured electrode layer 32 1 and the electric shield so as to allow shielding of the structured electrode layer 32 1 from external influences.
  • a further dielectric material is arranged on the surface of the structured electrode layer 32 1 opposing the film substrate 24 so as to obtain a possibly homogenous surface.
  • the electric shield may be arranged on that dielectric material.
  • embodiments of the first aspect provide for a solution of interconnecting different layers at which no vias have to be drilled or lasered (subtractive processes).
  • Both electric conductive layers are separated from each other by the used dielectric material, for example, the same material used for producing the capacitive array.
  • the dielectric material provides for a galvanic separation.
  • An interconnection of both layers may be formed at the edge or in holes of the dielectric layer. Connections and crossings may be used for interconnecting lines and/or rows of conductive traces with external electronics and/or with electronics being contained in the evaluating chip. This allows for arranging all layers or contacts thereof one side, e.g., the front side or the back side of the substrate. At the same time, inhomogeneities of the layer thickness of the dielectric layer may be used for obtaining a variation of the capacitive behavior between both layers of conductive traces.
  • conductor path layers 1 and 2 meet at the edge of the dielectric layer.
  • conductive traces may be combined, interconnected or galvanically coupled with each other, for example, for increasing capacitive values and/or for continuing the conductive trace, e.g., for connecting the conductive trace with an evaluation unit.
  • Fig. 3a shows a schematic top view on at least a part of a PUF-film 30 according to an embodiment in which the second region 44 is enclosed by the first region 42.
  • the dielectric material comprises an opening or a hole circumferenced by the material edge 46 allowing the structured electrode layer 32 1 to galvanically connect with the underlying structured electrode layer 32 2 , e.g., a conductive trace thereof.
  • Fig. 3b shows a schematic top view of a modified PUF-film 30' in which the second region 44 is adjacent to the first region 42 and forms an edge region of the first region 42.
  • the dielectric layer 28 does not cover the film substrate in the edge region allowing for interconnecting the structured electrode layers 32 1 and 32 2 in the edge region.
  • the PUF-film 30 may comprise a connector region or connector area in which the structured electrode layers 32 1 and 32 2 may be connected with an evaluation unit and/or a different apparatus.
  • a simple and robust connector may be used when the structured electrode layers 32 1 and 32 2 are arranged in a common plane which is possible when leading the structured electrode layer 32 1 into the plane or layer of the structured electrode layer 32 2 whilst keeping both structured electrode layers 32 1 and 32 2 galvanically separated from each other at the location of the connector so as to avoid short-circuits.
  • arranging the structured electrode layers 32 1 and/or 32 2 may be performed such that the structured electrode layers 32 1 and 32 2 are connectable in a common connector layer or surface.
  • the printing process may be adapted accordingly, for example, by defining the respective regions in the screen of a screen printing/silkscreen process.
  • the dielectric material may be a photosensitive material.
  • a method according to an embodiment may comprise a step of exposing the photosensitive material in an exposer region so as to develop the dielectric material in the exposing region and so as to define a mask of the dielectric material.
  • the dielectric material may be printed onto the complete surface of the film substrate. By exposing parts or regions of the dielectric material, regions in which the dielectric material remains and/or regions in which the dielectric material is removed afterwards may be defined, e.g., by hardening or softening the dielectric material based on the exposing.
  • Fig. 4 shows a schematic top view of at least parts of a PUF-film 40 in which both, the structure electrode layer 32 1 and the structured electrode layer 32 2 each comprise conductive traces 26 being arranged in a matrix-form comprising a number of N lines Z 1 to Z N and a number of M columns S 1 to S M .
  • the dielectric layer 28 is arranged between the structured electrode layers 32 1 and 32 2 and in the range of the crossings 48 i, j .
  • the dielectric layer may be absent so as to allow for an interconnection of the respective crossing conductive traces 26.
  • the crossings 48 may also be referred to as overlapping regions. According to embodiments of the first aspect, capacitive elements are formed in the overlapping regions 48 i, j .
  • a capacitance value of the capacitive elements 34 may vary stochastically based on the variation of the thickness of the dielectric layer due to the printing of the dielectric material. For example, this may allow for obtaining or generating cryptographic keys from the electric capacitance values, wherein tampering or modification of the PUF-film destroys the source of the key and therefore disables regeneration of the key and thus allows for detection of the tampering.
  • Fig. 5 shows a schematic top view on a PUF-film 50 having the first region 42 and the second region 44 between which the material edge 46 is arranged.
  • a plurality of conductive traces 26 1 to 26 10 extends between the regions 42 and 44 and thereby crosses the material edge 46.
  • the conductive traces 26 1 to 26 10 may be grouped into two groups of five conductive traces, each group containing five conductive traces having a width (extension perpendicular to an axial direction) of 20 ⁇ m and being spaced from each other by 20 ⁇ m. Any other configuration is possible without any limitation.
  • the capacitive value which may be described with the width of the conductive trace in the line and column on the one hand side and by the thickness of the dielectricum at the region of the crossing on the other hand.
  • the homogeneity of the dielectric layer may be influenced over the complete area, leading again to a random variation of the electric values of the capacitances.
  • the silkscreen process may provide for an inhomogeneity in the layer thickness of the dielectric layer.
  • differences in the layer thickness may be obtained by the topography of the substrate surface, the conductive traces being already arranged thereon respectively and before the dielectricum is arranged.
  • surface forces may influence the wetting behavior of the interface being formed by the substrate foil, the conductive traces, the dielectricum and thus results in a local variation of the layer thickness and in a random local variation of the single capacitances with respect to adjacent capacitances in different lines or columns.
  • typical symmetry effects may occur, for example, being axially symmetrical based on the lines of the screen and/or being rotational symmetric based on the rotation of the spin-coating process.
  • openings in the dielectric layer may be produced for enabling an electric connection between conductor path layer 1 and 2.
  • a size of the opening or edge, a steepness of the edge and a quality of the opening and/or edge and a homogeneity of the thickness of the dielectric layer can be influenced with the selection of the printing process.
  • there may be used exclusively additive processes in a simple embodiment such as a silkscreen process, a rotary printing process, an offset printing process, a pad printing process and a spin coating process or the like.
  • a combination with a photolithographic process is possible at which the previously described processes are used to deposit a photosensitive layer and for exposing the layer in regions, for example, in regions where the photosensitive dielectric is defined to remain. It is possible to use photosensitive permanent resists which may be deposited prior to exposing them with a laminator.
  • a dielectric layer is produced using a silkscreen process. By using a structured screen, it is possible to generate openings in addition to an outer edge of the dielectric layer. This allows for generating additional electrical connections between the conductive path layers 1 and 2, the structured electrode layers 32 1 and 32 2 respectively.
  • Silkscreen processes may comprise resolution limits being around 100 ⁇ m.
  • a photolithographic process For generating holes or openings having a lower pitch, i.e., smaller than 100 ⁇ m, i.e., less than 10 ⁇ m, there may be used a photolithographic process.
  • a typical screen may comprise 400 lines per inch providing for a respective resolution.
  • photoactive resist materials which may be used and which may be laminated over the complete area using a laminator, for example, onto the structured electrode layer 32 2 .
  • a different additive process may be used, e.g., a silkscreen process, an inkjet process, a pad printing process and/or a Gravure printing process. This allows for applying the layer over the complete area or pre-structured.
  • holes may be defined, for example, using ultraviolet exposure as known in the microsystems technology.
  • Embodiments provide for the advantage that based on the inhomogeneity of the layer thickness of the dielectric layer, the behavior of the grid of electrode structures is influenced.
  • This grid-like electrode structure may be used generating cryptographic keys.
  • the network of capacitances may be evaluated, for example, line-wise and/or column-wise, by using evaluation electronics, for example, a microcontroller, a central processing unit, a field programmable gate array (FPGA) or the like. Differences or variations in capacitance values between lines and/or columns may be transformed so as to allow derivation of cryptographic keys by use of mathematic processes and/or software, Such a cryptographic key may be used for encrypting data.
  • evaluation electronics for example, a microcontroller, a central processing unit, a field programmable gate array (FPGA) or the like.
  • Differences or variations in capacitance values between lines and/or columns may be transformed so as to allow derivation of cryptographic keys by use of mathematic processes and/or software,
  • an un-allowed attempt for spying on and/or for tampering may be detected.
  • An attempt for spying on may include a mechanical variation of the foil array, e.g., due to scratching, drilling, piercing or the like.
  • the mechanic damage results in a change of the electric values of the capacitances and therefore results in a detectable event that may be detected by the evaluation electronic.
  • the through-contacts may be produced in an additive way, a cost-efficient possibility is generated for increasing the integration density of the circuit structures. It is possible to generate wiring layers for electric components such as microcontrollers or ICs in a same process step as the capacitance array.
  • Fig. 6a shows a schematic perspective view of a PUF-film 60 according to an embodiment of the second aspect.
  • the PUF-film 60 comprises a PUF-carrier 52 which may comprise, for example, the film substrate 24, the dielectric layer 28 and/or further layers.
  • the PUF-film comprises a circuit structure 54 having a plurality of circuit elements.
  • the plurality of circuit elements may be, for example, the conductive traces 26 such that the circuit structure 54 may be or may at least comprise the structured electrode layer 32 1 .
  • the circuit structure 54 is evaluable with respect to a plurality of electric capacitance values 34 1,2 and 34 2,3 being arranged between the plurality of circuit elements, in particular between the conductive traces 26 1 and 26 2 , between the conductive traces 26 2 and 26 3 respectively.
  • the circuit structure 54 is further evaluable with respect to a plurality of electric resistance values 34 1 , 34 2 and 34 3 associated with or comprised by the respective conductive trace 26 1 to 26 3 .
  • the resistance values are comprised by the same structures evaluated for the capacitance values.
  • capacitance measurement may be performed between two of the circuit elements.
  • the electric resistance value may be measured or evaluated or determined between a first section 56 1 , 56 2 , 56 3 respectively and a second section 58 1 , 58 2 , 58 3 respectively of the respective circuit element.
  • the first and second sections 56 may be, for example, ends of the conductive traces 26 and/or may be regions accessible through the dielectric material, for example, at regions of a hole therein.
  • the circuit elements of the circuit structure 54 may be embedded in dielectric material, wherein the dielectric material may also comprise conductive granule and/or contamination leading to defects in the circuit structure 54, e.g., short circuits or open circuits. Further, when compared to evaluation of capacitance values, evaluation of resistance values may provide for additional information which respect to an attack on the PUF-film 60.
  • Fig. 6b shows a schematic side view of a PUF-film 60' according to an embodiment of the second aspect.
  • the PUF-film 60' provides for a high entropy whilst using a simple and therefore robust architecture.
  • the PUF-film 60' comprises the film substrate 24 having two opposing main surfaces or main sides 24a and 24b, the substrate 24 providing for a dielectric layer.
  • the main sides 24a and 24b may be considered as those sides of a film or foil having the largest surface area and opposing each other.
  • the structured electrode layer 32 1 On the first main side 24a the structured electrode layer 32 1 may be arranged, wherein on the second side 24b the structured electrode layer 32 2 may be arranged.
  • both structured electrode layers 32 1 and 32 2 may be formed as will be described in connection with Fig.
  • the PUF-film 60' may comprise a layered structure in which the dielectric foil substrate 24 is arranged between the first trace layer 32 1 and the second trace layer 32 2 so as to form the plurality of electrical capacitance values 34 in overlapping regions of the first and second trace layer 32 1 and 32 2 . At least one of the trace layers 32 1 and 32 2 is covered at least partially with a dielectric layer 28 1 , 28 2 respectively, which is applied, for example, by way of printing, wherein the printing may be combined with a laser ablating process. This allows for a high entropy of the architecture.
  • the PUF-film 60' may be obtained by embodiments according to the first aspect in which a printing is performed on one or both sides of the substrate 24. When compared to the PUF-film 20, the substrate 24 may be formed so as to comprise the structured electrode layer 32 1 and 32 2 . The printing may be performed on both sides.
  • the first and/or second structured electrode layers 32 1 and/or 32 2 may be already arranged when providing the film substrate 24 and/or may be generated or deposited after providing the film substrate 24, wherein in both cases prior to the printing at least the first structured electrode layer 32 1 , preferably both structured electrode layers 32 1 and 32 2 are present.
  • a method according to an embodiment may comprise providing the film substrate 24 for the printing 1010 so as to have the two opposing main sides 24a and 24b and having the first structured electrode layer 32 1 on the first main side 24a and the second structured electrode layer 32 2 on the second main side 24b.
  • the film substrate 24 may provide a dielectric layer with respect to the first and second structured electrode layers and may thus allow for generating and obtaining the capacitance values to be measured.
  • the dielectric material being printed thereon may allow for diversification or falsification or manipulation of the capacitance values.
  • the printing 1010 may be performed on the first structured electrode layer 32 1 and/or on the second structured electrode layer 32 2 .
  • Fig. 7a shows a schematic top view of a circuit structure 54 comprising a 2 x 2 matrix of conductive traces 26 as described in connection with Fig. 4 .
  • Fig. 7a shows the circuit structure 54a in a mesh layout level.
  • Accessible or connectable sections 56 and/or 58 are further marked with TX1 and TX2 so as to indicate an input-interface or input-support of the circuit element.
  • Second sections 58 1 and 58 2 are marked with TX1R, TX2R, respectively, so as to indicate a second interface or port thereof. Simplified, a signal may be applied between TX1 and TX1R and/or between TX2 and TX2R.
  • sections 56 3 and 56 4 and sections 58 3 and 58 4 of conductive traces 26 3 and 26 4 of the structured electrode layer 32 2 same applies for sections 56 3 and 56 4 and sections 58 3 and 58 4 of conductive traces 26 3 and 26 4 of the structured electrode layer 32 2 .
  • the "T" used in connection with the circuit structure 32 1 indicates a possibility of applying an excitation signal to the respective conductive trace 26 1 and/or 26 2 , wherein the "R” is used so as to indicate that a signal inducted by way of the signals applied to the conductive traces 26 1 and 26 2 may be evaluated or received at those lines.
  • the description is interchangeable without any limitation and is for simplification only.
  • Fig. 7b shows a schematic block diagram of the circuit structure 54a on an equivalent circuit level. I.e., Fig. 7b shows an equivalent circuit of the circuit structure 54a.
  • the electric properties 34 1,1 to 34 2,2 are arranged and implemented by way of capacitance values. Those capacitance values are capacitance values effective between the respective conductive traces.
  • Each conductive trace 26 1 to 26 4 is further effected by a capacitance value 64 1 to 64 4 being formed by the conductive trace 26 and a common shielding 62.
  • the capacitance values 64 1 to 64 4 may be larger when compared to the capacitance values 34 1,1 to 34 2,2 .
  • the capacitance values 64 1 to 64 4 may be larger by a factor of at least 100, at least 200, at least 500 or even at least 1000 when compared to the capacitance values 34 1,1 to 34 2,2 .
  • the capacitance values 64 1 to 64 4 and/or of the capacitance values 34 1,1 to 34 2,2 may be suitable in connection with evaluating the resistance values between the terminals TX1 and TX1R, TX2 and TX2R, RX1 and RX1R and/or RX2 and RX2R.
  • the evaluation unit may be configured for evaluating changes in the differential electric capacitance, i.e., the difference in the electric capacitance value with a resolution so as to enable detections of changes having a factor of at least 20 when compared to the differential electric capacitance value. This allows for evaluating even minor changes in the PUF-film.
  • the capacitance values 34 1,1 to 34 2,2 may be very sensitive to tampering attempts.
  • the circuit structure 54 and/or the circuit structure 54a in connection with the PUF-foil 60 may be regarded as well-tailored measurement circuit that is suited for PUF-based capacitive enclosures.
  • a cryptographic key may be derived from the PUF and used to encrypt the underlying system. Any penetration destroys the key and thus prevents tampering with the powered-off system.
  • the circuit structure comprises conductive traces on two (or more) layers which are separated by a non-conducting dielectric such as polyimide.
  • the enclosure may be covered by a grounded shield such as the shield 62 on the top and/or the bottom.
  • the trace structure on both layers may be orthogonal to each other.
  • the mesh may span across the entire surface of a device to be protected.
  • a spacing between traces may be a fixed parameter which may be set to 300 ⁇ m, 200 ⁇ m, 100 ⁇ m or even less, e.g., 50 ⁇ m or the like.
  • the PUF-film 60 may be used to cover an enclosure of a module under protection.
  • Fig. 7a and 7b illustrate two conductive traces per layer (structure electrode layer 32) also a higher number may be used, for example, four, six, seven, eight, ten or even more such as sixteen or more.
  • N may be, for example, 16.
  • the electrodes (conductive traces) may then be routed, for example in a meander-like out, to fill the entire layer. This may result in N 2 combinations of capacitive coupling between top and bottom-layer electrodes.
  • N ⁇ M allowing for a different configuration of e.g., 32 ⁇ 16, 32 ⁇ 8, wherein for both, N and M any suitable number of at least 1 may be applied, e.g., 2, 3, 4, 6, 8, 10 or more such as more than 15, more than 30 or even higher.
  • each capacitor is built from hundreds up to thousands of tiny trace overlaps connected in parallel, each individually contributing to the total variation capacitance.
  • one of the layers such as the top layer 32 1 may be excited by a signal and the bottom layer such as the layer 32 2 may receive a signal with an amplitude proportional to the capacitive coupling.
  • the top/bottom, up/down, left/right or the like are used for explanatory reasons only and do not limit the scope of the embodiments described herein.
  • the top layer traces are labeled TX electrodes
  • the traces on the bottom are called RX electrodes.
  • Each electrode trace is accessible at both ends, whereas its rear end is designated by an "R" suffix. This allows trace integrity verification and short circuit detection. In the following, it is assumed that the electrode resistance of an intact electrode is low and therefore negligible.
  • Each coupling between TX and RX electrode is modeled as mutual capacitance 34 also referred to as C m .
  • C11 defines the mutual capacitance between TX1 and RX2.
  • the difference of two mutual capacitances is defined as ⁇ C.
  • Every electrode has a (parasitic) capacitance towards the ground shielding which is denoted as Cs.
  • Cs may have values, for example, between 0.2 nF and 2 nF. Depending on the size and manufacturing technology of the enclosure, those values may vary.
  • the (mutual) capacitance values 34 may be three orders of magnitudes smaller and may range, for example, from 10 pF to 20 pF.
  • the PUF-variation of ⁇ C i.e., the differential capacitance, is, for example, again three orders of magnitude smaller with a 1 ⁇ interval of [-8 fF; +8 fF].
  • Three orders of magnitude may mean a factor of 10 3 .
  • a difference of at least 100 (two orders of magnitude) 200 or 500 is present.
  • Fig. 8a shows a schematic top view of a circuit structure 54b according to an embodiment of the second aspect.
  • four conductive traces 26 1 to 26 4 according to the description accompanying Fig. 7a and 7b are illustrated, wherein a different and in particular higher number may be used. This is indicated by optional sections TX3/TX3R, TX4/TX4R and RX3R, RX4R respectively.
  • the conducting traces 26 1 to 26 4 are arranged in a first trace layer of the PUF-film and are arranged in a second trace layer of the PUF-film.
  • the conductive traces 26 1 and 26 2 are arranged in layer 1, wherein the conductive traces 26 3 and 26 4 are arranged in layer 2.
  • Each of the conductive traces 26 1 and 26 2 overlaps with at least one, a plurality or alternatively each of the conductive traces 26 3 and 26 4 of the respective other layer in a plurality of overlap regions 48 so as to form a corresponding plurality of capacitor structures in the overlap regions 48.
  • Each electric capacitance value evaluable by evaluating the respective conductive trace 26 is based on at least a first and a second capacitor structure 34 when providing for a plurality of overlaps between each of the conductive traces.
  • the resistance value may be present and measurable between the ends of the circuit elements.
  • the plurality of conductive traces in layer 1 and the plurality of conductive traces in layer 2 may each be meandered, wherein the conductive traces 26 1 and 26 2 span a film region 66 1 in which they are meandered.
  • a film region 66 2 is spanned by a region in which the conductive traces 26 3 and 26 4 are meandered.
  • a region in which the film regions 66 1 and 66 2 overlap with each other, i.e., in which the conductive traces of both layers are meandered, may be referred to as a sensoric region.
  • the sensoric region may be a region in which the PUF-film is adapted for securely covering a device to be protected such as an enclosure.
  • the plurality of overlaps 48 may be arranged.
  • the conductive traces 26 may meet each other orthogonally in the overlap regions 48.
  • the conductive layer 28 may be arranged such that a portion 72 1 of the conductive trace 26 1 , a portion 72 2 of the conductive trace 26 2 , a portion 72 3 of the conductive trace 26 3 and/or a portion 72 4 of the conductive trace 26 4 extends over the material edge 46 of the dielectric layer 28 so as to extend in a different layer whilst avoiding an implementation of vias. This may be of advantage in view of manufacturing costs and manufacturing efforts.
  • each conductive trace in the first layer and the second layer is exclusively neighbored by a different conductive trace along an axial course of the trace by arranging the conductive traces in an interleaved manner.
  • the interleaved arrangement is preformed such that the conductive trace 26 1 is only neighbored by a different conductive trace, i.e., the conductive trace 26 2 in the same plane. This allows for detecting short circuits by monitoring resistance values and/or capacitance values between different conductive traces.
  • Fig. 8b shows a schematic block diagram of an equivalent circuit of the circuit structure 54b, being a logical representation of the Fig. 8a .
  • electric properties 34 i.e., capacitance values may be present between overlapping conductive traces.
  • Fig. 9 shows a schematic top view of a circuit structure 54c comprising a comparatively larger sensoric region 74 when compared with the concept according to Fig. 8a , i.e., the circuit structure 54b.
  • a higher amount of changes in the layers may be present, i.e., a high amount of extensions of the conductive traces 26 1 to 26 4 over edges of the dielectric material.
  • an extension of the sensoric region may be obtained because a low amount of area is required for symmetric winding.
  • a width 76 of the traces may be individual or may be globally set and may comprise, for example, a value of approximately 100 ⁇ m. Further, a spacing between two adjacent conductive traces may also be 100 ⁇ m. This allows for a configuration in which a drill attack with a drilling tool having a diameter of 300 ⁇ m damages at least two conductive traces, which is easily detectable.
  • the PUF-film may comprise the dielectric material so as to comprise at least one granule material being arranged in a stochastic distribution in the dielectric material so as to influence the plurality of electric capacitance values.
  • Fig. 10 shows a schematic block diagram of an apparatus 100 according to an embodiment of the second aspect.
  • the apparatus 100 comprises a PUF film such as the PUF-film 60, wherein the PUF-film may comprise any of the circuit structures described herein.
  • the apparatus 100 further comprises an evaluation unit 78 configured for differentially evaluating the electric capacitance values of the PUF-film 60 so as to obtain a first evaluation result.
  • the evaluation unit 78 is further configured for evaluating the plurality of electric resistance values so as to obtain a second evaluation result.
  • the first evaluation result may be a result for determining the capacitance value as precise as required or possible within tolerable ranges, e.g., having a resolution of at least 1/20 of the total capacitance variation, e.g. 0.x fF at a maximum variation of ⁇ 47 fF.
  • the second result may be in contrast a pass/fail result which determines whether the resistance values are within a tolerance range or not.
  • Evaluating the electric capacitance value differentially may refer to comparing absolute values of capacitance values which are, at least by means of a system layout, equal.
  • Each of the two capacitance values may comprise an absolute capacitance value, e.g., a first absolute capacitance value between a first and a second trace and a second absolute capacitance value between a third trace and the first, second or a fourth trace.
  • a differential capacitance value may be obtained.
  • the evaluation unit 78 may be configured for evaluating the electric capacitance values 34 1,2 and 34 2,3 for differentially evaluating the electric capacitance value of the conductive trace 26 1 and 26 2 , 26 2 and 26 3 , respectively.
  • the capacitance values 34 1,1 to 34 2,2 may be evaluated differentially.
  • each of the capacitance values 34 1,1 to 34 2,2 may be generated or influenced by a plurality of overlaps of the respective pairs of conductive traces 26 1 /26 3 , 26 1 /26 4 , 26 2 /26 3 and 26 2 /26 4 .
  • the plurality of circuit elements comprise at least a first conductive trace, a second conductive trace and a third conductive trace, which are, for example, conductive traces 26 1 , 26 2 and 26 3 .
  • the conductive traces 26 1 and 26 2 both overlap with the conductive trace 26 3 .
  • a first electric capacitance value 34 1,1 is arranged between the conductive traces 26 1 and 26 3
  • a second electric capacitance value 34 2,1 is arranged between the conductive traces 26 2 and 26 3 .
  • the electric capacitance values 34 1,1 to 34 2,2 may be referred to as absolute capacitance values.
  • the evaluation unit 78 may be configured for applying a first excitation signal to the first conductive trace, e.g., at the terminal TX1, and for simultaneously applying a second excitation signal to the second conductive trace 26 2 , e.g., at the terminal TX2..
  • the evaluation unit 78 may further be configured for receiving a response signal from the third conductive trace 26 3 , e.g., at the terminal RX1 so as for differentially evaluate the electric capacitance value between the first and the second trace 26 1 and 26 2 .
  • the evaluation unit is configured for providing the first and second excitation signal in antiphase with respect to each other, i.e., having a phase of approximately 180° whilst having a same amplitude
  • the evaluation unit may also be configured for provide antiphasic signals within a tolerance range of at most 10°, at most 5° or at most 2° and an amplitude matching of at least 20dB, at least 40 dB or more, preferably at least 60 dB.
  • An amplitude matching of 60 dB is to be understood as both amplitudes have a mismatch of at most 0.1 % (10 -3 ).
  • further lines may be excited using at least a third and a fourth signal.
  • a corresponding signal may be received and evaluated from conductive trace 26 4 .
  • a different pair, differing in at least one conductive trace, of exciting traces may be used and/or different reception traces may be used.
  • the evaluation unit may be configured for measuring changes, i.e., deviations from one another and/or changes over time, in the (absolute) electric capacitance values 34 1,1 to 34 2,2 with a resolution being smaller by a factor of at least 100 (at least 2 orders of magnitude) when compared to the capacitance values 34 1,1 to 34 2,2 .
  • Those capacitance values 34 1,1 to 34 2,2 may be smaller by a factor of at least 100 when compared to the electric capacitance values of each of the conductive traces in relation to a common reference electrode, e.g., a common shielding, being referenced as Cs in Fig. 7b .
  • the second evaluation result may be obtained by the evaluation unit 78 based on an evaluation of the electric resistance value of the plurality of conductive traces 26 1 to 26 4 .
  • Resistance values may be in the range of at most 100 ⁇ , at most 70 ⁇ or at most 50 ⁇ This may include monitoring each of the resistance values of the individual traces 26 but may also comprise resistance values between different traces. Wherein the first case a high resistance may be a hint for a defect of attack, in the latter case, a low resistance may give a hint for an attack or a defect.
  • a first capacitance may refer to a capacitance value of a conductive trace with respect to a reference electrode and may be referred to as parasitic capacitance.
  • a so-called absolute capacitance may be the total capacitance of a conductive trace of a first layer with respect to a conductive trace on a second layer.
  • the differential and third capacitance may be the difference between the two absolute capacitances.
  • the evaluation unit 78 may be configured for compensating the first evaluation result and/or the second evaluation result for an environmental parameter such as a temperature, a humidity, ageing effects, a measure for electromagnetic radiation, a pressure or the like. Those environmental parameters may influence resistance values and/or the electric capacitance values in a known way and may thus be compensated for.
  • the evaluation unit 78 may comprise respective sensor elements, may be connected to such sensor elements and/or may extract such information from the first, second, or an additional evaluation result and/or may receive information containing information about the environmental parameter.
  • the effect of temperature, humidity or the like may be pre-known to the evaluation unit so as to allow a feed-forward compensation.
  • the evaluation unit may be configured for determining additional values such as the absolute capacitance value of one or more pair of traces. This may be obtained without significant additional effort because differential measurement of the capacitance values may be performed in a similar way. When compared to a differential capacitance value, an absolute capacitance value may be obtained using only one instead of at least two excitation signals.
  • the evaluation unit may apply an excitation signal that may comprise a same or different, preferably lower signal amplitude for exciting the traces and for determining the absolute capacitance values.
  • Those absolute capacitance values may also vary over time or affected by the parameters to be compensated such that by measuring the absolute capacitance values a precise compensation of the environmental parameter may be obtained.
  • an absolute capacitance value related to the differential capacitance value may be used.
  • an unrelated or different absolute capacitance value may be used based on assumptions such as a comparable influence of the external parameter on all absolute and thereby differential capacitance values.
  • the evaluation unit 78 may be configured for using absolute capacitance values and/or measurements for compensating an environmental parameter or effect.
  • the absolute capacitance value such as one or more of the capacitance values 34 1,1 to 34 2,2 may be obtained by the evaluation unit by evaluating same between a pair of traces 26 of the circuit structure such as the circuit structure 32, 54 or 54a or a different circuit structure. This may be done at a first instance of time, e.g., during regular intervals of some seconds, minutes, hours or days but also only once, e.g., during manufacturing or the like.
  • the evaluation unit 78 may further be configured obtaining the absolute capacitance value at a second instance of time, e.g., in regular intervals, at specific events such as power-up or the like or after time interval subsequent to the first evaluation.
  • Signals used for exciting the pair of traces 26 may not be required to be antiphasic because of the time difference between the measurements and the independency of both measurements. Any two different traces 26 may be used as pair of traces, wherein in PUF-films having a corresponding circuit structure, it is advantageous to use traces 26 having an overlap with each other so as to allow a comparatively high absolute capacitance value.
  • the evaluation result 78 may be configured for comparing the absolute capacitance value evaluated at the first instance of time and the absolute capacitance value evaluated at the second instance of time so as to obtain an absolute capacitance evaluation result, e.g., a relative or absolute difference or variation, probably set in relation with the time having expired between the first and second instance of time. Based thereon, the evaluation unit 78 may derive information related to the environmental parameter, e.g., the temperature and/or may derive a correction parameter for correcting a result of the differential measurement ,so as to compensate the first evaluation result for the environmental effect.
  • an absolute capacitance evaluation result e.g., a relative or absolute difference or variation
  • the evaluation unit 78 may have access to a memory having stored thereon the information related to the environmental parameter, e.g., in a look-up table, and/or as a function or the like. From the absolute capacitance evaluation result, by way of example, a relative deviation such as 1 %, 5 % or 10 %, the evaluation unit may derive information that a temperature to which the device is exposed has fallen by a specific relative or absolute value such as X°C, X being any applicable value. With this temperature information or an information derived thereof, the differential measurement or result thereof may be corrected or compensated, e.g., using a function or look-up table.
  • the absolute capacitance value evaluated at the first and/or second instance of time and/or the absolute capacitance evaluation result may be used by the evaluation unit 78 for detecting an attack on the PUF-film, e.g., when determining a too fast change of the absolute capacitance value and/or a deviation exceeding the changes expected in the specified temperature range.
  • the evaluation unit may be configured for determining an attack on the PUF-film.
  • the first and second evaluation result may be obtained in parallel and/or cyclically during a runtime or powered time of the apparatus.
  • the first and second evaluation result may be determined during different time instances such as verifying the second evaluation result during or after a power-up of the apparatus in combination with a cyclic monitoring of the first evaluation result thereafter and during runtime.
  • the evaluation unit may perform counter measures such as a zeroing, i.e., deleting data from a storage.
  • a zeroing i.e., deleting data from a storage.
  • decrypted data and/or unencrypted may be deleted from a storage. This may be performed, for example, by performing a re-boot and thereby resetting volatile memories and/or by actively overwriting the data.
  • Zeroing may also comprise the deletion of a key including additional data such as raw measurement data derived from the electric capacitance values.
  • the evaluation unit 78 may be configured for determining a cryptographic key based on the plurality of electric capacitance values 34 at a first instance of time.
  • the cryptographic key may be determined or derived from the electric capacitance values with any public or secret algorithm or scheme and may be used to encrypt data used for operating the apparatus to be protected.
  • Such encrypted data obtained by encrypting may be stored, for example, in a memory of the apparatus or in an outsourced memory. Afterwards, the derived cryptographic key may be deleted.
  • the evaluation unit 78 may, again, derive the cryptographic key from the electric capacitance values 34.
  • the second cryptographic key will only be equal to the first cryptographic key in a case when the electric capacitance values are (within the tolerance range) unchanged. Only the unchanged cryptographic key may allow for reading and decrypting the encrypted data. Thus, when reading the encrypted data and having determined a modified or wrong cryptographic key, decryption of the encrypted data will fail. Thereby, protection of the apparatus may be performed battery-less.
  • embodiments cover alternatively or in addition other concepts of using a key such as signing and verifying data using cryptographic keys.
  • the data to be encrypted may be a key itself, e.g., a private key for RSA encryption.
  • data may be encrypted and decrypted, wherein the decrypted data may comprise or be further keys for different encryption purpose such as signatures.
  • a configuration of the evaluation unit 78 may be adapted to application specific requirements. Such requirements may include, without limitation, that the system is required to perform differential measurement of capacitive nodes and has to verify the integrity of the enclosure, combined in one single circuit. Such a task may be required to be carried out targeting a reasonable time frame of, by way of non-limiting example, less than 1 s, e.g., less than 400 ms, less than 200 ms or less than 100 ms for measurement and detection of an intrusion so as to enable a quick countermeasure.
  • a capacitive measurement performed by the evaluation unit may be carried out with a precision/resolution of 1 fF or higher, i.e., smaller values to be measured.
  • the resolution is high enough, e.g., 1/20 with respect to an example variation range of 20 fF this results in a resolution of 1 fF or more.
  • Other values are at most 1/25 or at most 1/30.
  • the system circuit's power dissipation may be limited so as to not exceed, for example, 5 watts, 2 watts or 1 watt or even less.
  • the deployment in a security product may implicitly require the measurement concept not to be side-channel prone, i.e., the measurement may be required to be leakage-reduced and time-constant.
  • the chosen concept may be required to be scalable to adapt the enclosure to be protected to different typical form factors of embedded systems.
  • the circuit may support performance-optimized as well as area-optimized implementations.
  • the explained differential evaluation may have advantages over several concepts for capacitive sensing [14] of which the following were ruled out for the application.
  • the DFT-based in-enclosure differential capacitance measurement concept may be used.
  • the basic idea is as follows: The measurement is moved from the time domain into the frequency domain. Additionally, the capacitance subtraction may be shifted into the enclosure, instead of struggling with subtraction afterwards in the analog or digital circuit. Wherever possible, analog circuitry may be replaced with digital signal processing to counteract external influences, component imperfections, and aging.
  • Fig. 11 shows a schematic block diagram of a measurement concept according to an embodiment of the second aspect in which three conductive traces are used.
  • the evaluation unit 78 may comprise a dual digital-analog-converter (DAC) as a sine generator for generating two antiphasic sine signals 84 1 and 84 2 .
  • the dual-DAC 82 may provide a transition between a digital domain 86 and an analog domain 88.
  • the measurement concept may use in-enclosure currents subtraction to measure the differential capacitance by mutual cancellation of currents.
  • the enclosure in the block diagram of Fig. 11 is exemplarily reduced to two TX electrodes and a single RX electrode, wherein enclosure refers to the PUF-film.
  • Some embodiments are directed to measure a variation in differential capacitances, it may be of an advantage to implement both capacitances (per design) as equal. A difference therebetween corresponds to deviation during manufacturing and thus is a PUF.
  • a balanced electrode layout thus is directed to a capacity of both electrodes being the same, for example, by designing the areas of both electrodes as equal.
  • a balanced electrode layout as described in connection with Figs. 8a and 9 may ensure that neighboring TX electrodes have the same mutual capacitance C m towards the RX electrode by design, not taking in manufacturing variation. When referring again to Fig. 7b , this may indicate, that without manufacturing variation, the capacitance value 34 1,1 equals the capacitance value 34 2,1 within a tolerance range. This may allow to insulate the manufacturing variation ⁇ C which may differ for each TX and RX combination.
  • a phase shift of 180° is applied to the signal at the, e.g., even-numbered electrode, thereby inverting the signal.
  • signals 96 1 and 96 2 applied to different conductive traces 26 1 and 26 2 may be antiphasic. This may generate two currents proportional to the mutual capacitance, flowing from two TX electrodes to one RX electrode.
  • I _ RX j ⁇ V TX ⁇ C m + j ⁇ ⁇ V TX ⁇ C m + ⁇ C
  • Equation (2) shows that the complex current I RX is directly proportional to the variation in capacitance ⁇ C.
  • the equation is independent from C m and C s , thus, neither the mutual capacitance nor the shield capacitance influences I RX .
  • the RX current ranges from sub-nanoampere up to few nanoamperes.
  • a JFET-based (junction gate field-effect transistor) transimpedance amplifier (TIA) which is a current-to-voltage converter, translates the current I RX into a voltage. Subsequently, the voltage is processed by high-pass (HP) and low-pass (LP) filtering and amplification stages to remove any offsets prior to amplification. Finally, the signal is digitized by an analog-to-digital converter (ADC).
  • the evaluation unit comprises a transimpedance amplifier such as TIA 98 being configured for providing a voltage signal based on a current signal received from a circuit element.
  • ⁇ C is reconstructed by determining the RX signal's amplitude and phase. Instead of solving this issue in the time domain the signal is transformed into the frequency domain using a digital dual-phase lock-in amplifier approach. Therefore, the system performs a frequency analysis by applying a Discrete Fourier Transform (DFT) on the digitized RX time domain signal.
  • DFT Discrete Fourier Transform
  • This filter bank splits the signal into its frequency components, thus, separating most of the noise from the signal.
  • DFT Discrete Fourier Transform
  • a negative ⁇ C has a phase shift of 180° relative to a positive
  • two decision regions are defined representing a negative and positive capacitance difference, respectively.
  • This method may profit from a strict synchronization of the signal generation with the ADC data acquisition in order to preserve this phase information.
  • an algorithm rescales the data relative to the (arbitrarily chosen) full-scale value of ⁇ 10000. This completes the measurement circuit's data handling, as the raw PUF data is available in a usable format.
  • the evaluation unit 78 may comprise a transimpedance amplifier being configured for providing a voltage signal based on a current signal received from a circuit element, i.e., the conductive trace 26 3 .
  • Embodiments allow for an integrity verification method executed by the evaluation unit and directed to the electrodes, e.g., the conductive traces. Integrity may be verified during assembly of the envelope. Later in the field, the integrity verification detects tamper events. The system checks whether an electrode is interrupted or if shorts to other electrodes exist. As it is impractical to disconnect one or the other circuit, the integrity verification is combined with the capacitance measurement circuit and components are shared. This is implemented as follows.
  • Fig. 12 showing an example block diagram of a JFET-TIA for RX current-to-voltage conversion and amplification
  • the JFET-TIA may be the transimpedance amplifier 98. It will be understood by those skilled in the art, that a same functionality may be implemented with different circuits and that the evaluation unit may also be equipped with different functionality alternatively or in addition to the description provided hereinafter.
  • the example measurement system is controlled by a STM32F303 microcontroller. It features an ARM Cortex-M4 core including a floating-point-unit (FPU) and signal processing extensions. Additionally, the microcontroller provides all necessary peripherals, such as DACs, ADCs, direct memory access (DMA), and zero-waitstate core-coupled-memory (CCMRAM).
  • DACs digital to analog converters
  • ADCs analog to digital converters
  • DMA direct memory access
  • CCMRAM zero-waitstate core-coupled-memory
  • the system is well suited for our measurement, as DAC signal generation and ADC signal acquisition can be configured to run in hardware, freeing the CPU from load.
  • the frequency has shown to be an adequate trade-off between several optimization goals and limits.
  • Nine periods of the excitation signal are generated, whereas one period is for circuit startup and eight periods are for measurement, resulting in only 270 ⁇ s per node.
  • the signal acquisition operates with 12 bit resolution at 5.14 MS/s to oversample the signal for noise reduction.
  • a JFET-based TIA setup is adapted, which is often used in optics to amplify a tiny photodiode current at a node of high capacitance [17].
  • Our adjusted circuit is depicted in Fig. 12 .
  • the circuit combines a high GBW operational amplifier with a low input bias JFET (IT1) to create an improved TIA.
  • the JFET acts as pre- amplifier in the circuit.
  • the components R2 and R3 set the DC operating point of the circuit. Thereby, V OUT as well as the RX electrode voltage are set to a DC steady-state voltage of approximately 1.65 V.
  • the GBW may be 720 MHz, wherein, depending on the size of the PUF-film and the layout, a lower value may be sufficient or a higher value may be required.
  • the TIA allows for a low noise and allows the circuit to be robust against operation-amplifier-bias-currents.
  • the JFET may be substituted or may be missing.
  • the operational amplifier may be connected as a transimpedance amplifier directly on the PUF-film. Although this may lead to an increase of noise and/or a requirement to use special operational amplifiers, this may allow for a simple layout.
  • the circuit implements a control loop that maintains 1.65 V at the RX electrode by varying the output voltage V OUT .
  • the RX electrode current I RX causes a slight increase in RX voltage, causing the JFET to open and carry more current via its drain-source channel. This decreases the voltage at the non-inverting input of the operational amplifier. It leads to a decrease in output voltage V OUT that pulls current through the feedback network R 1 ⁇ C 1. This reduces the RX voltage to its original level. The equilibrium is reached when the current through the feedback network is equal to the RX electrode's current.
  • the impedance of the feedback network controls the relation between I RX and V OUT i.e., it sets the TIA's gain. With this configuration, the TIA has a gain magnitude of 0.8 - 10 6 V / A at an excitation frequency of 33.3 kHz and 1.0-10 6 V / A at DC.
  • a high-pass filter 108 strips its DC component. To further amplify the signal, it is fed to an inverting amplifier 112 with a gain of - 100 ⁇ 40 dB which scales the signal to the ADC's dynamic range.
  • This amplifier is implemented as active first order low-pass filter 114 to prevent aliasing during digitization.
  • the low output impedance of the active filter allows the signal to be directly connected to the ADC 116 (Analog-to-Digital Converter) without a buffer.
  • an LT1719 comparator is used, BAS516 diodes, and 74HC595 shift registers as digital outputs, controlled via SPI.
  • the signal processing extracts the amplitude and phase from the RX signal using a dual-phase lock-in amplifier.
  • the ADC sampling may be strictly synchronized with the DAC excitation since the internal DAC signal serves as lock-in reference signal. This is achieved by interconnecting microcontroller peripherals such as timers, DMA, ADC, and DAC, providing a fixed phase relation for acquisition.
  • a windowing function is applied to the data. Since the frequency of interest is known, a rectangular window covering eight full periods of the signal is used. By choosing an integer number of periods for the window length, most information is preserved and spectral leakage at this frequency is not observed.
  • the algorithm runs on the FPU which delivers single-cycle multiplication, addition, and subtraction. All intermediate values are kept in FPU registers continuously, speeding up computation. Performance is further increased by moving the algorithm from flash memory into CCMRAM. This reduces the computation time for one node by 25 % down to 258 ⁇ s.
  • Fig. 13a shows a schematic block diagram of an apparatus 130 according to an embodiment of the second aspect, in which multiplexors, e.g., analog multiplexors may be included, and in which Fig. 13b shows a schematic photography of an experimental setup
  • a dual multiplexor 122 may be connected to input terminals of conductive traces so as to variably apply not necessarily antiphasic signals, e.g., the signals 96 1 and 96 2 to conductive traces.
  • a multiplexor 124 may be configured for providing for a respective circuitry on the second end of the conductive traces.
  • a multiplexor 126 may be configured for multiplexing the conductive traces in the second layer, wherein those traces may be connected to a current source 128 so as to facilitate measurements.
  • the evaluation unit may comprise analog circuitry 132 and/or digital circuitry 134 as well as communication and debug interfaces 136, wherein the latter are optional. Alternatively or in addition, the evaluation unit may also be implemented without digital circuitry. The concept may scale the circuit to N x M enclosures.
  • analog multiplexers are introduced, as shown in Fig. 13a .
  • a dual multiplexer with N / 2 outputs each is required. The first one connects the 0° excitation signal to odd-numbered electrodes, the second multiplexer connects the 180° excitation signal to even-numbered electrodes.
  • a single multiplexer with N inputs is connected between the TXR outputs and the TX integrity verification comparator.
  • an M input multiplexer is connected after the first stage RX amplifiers.
  • no multiplexers are required.
  • the current source can easily be scaled by adding more shift registers, i.e., a corresponding number of resistances and diodes may be included which may be controlled by the registers.
  • the circuit can also be scaled by parallelization by adding further comparators and signal-processing chains.
  • the example circuit is area-optimized.
  • An example circuit may be implemented for a 16 x 16 enclosure.
  • the experimental setup is shown in Fig. 13b .
  • the circuit features a four-layer board, providing power planes and shields, separating analog and digital signals.
  • the device is divided into three regions, the analog measurement circuit, the digital circuit, and the debug interfaces.
  • An external board was added, replacing the original TX amplifier with an improved version.
  • the circuit draws 132 mA on the analog rail and 43 mA on the digital rail at 3.3 V. This results in a power dissipation of 0.6 W which is within specification.
  • the measurement circuit supports a full-scale range of ⁇ 73 fF ( ⁇ 10, 000 points) at a theoretical digital resolution of 7.3aF. However, precision is limited by the circuit's measurement noise of 0.3 fF ( ⁇ 41 points) in the current setup.
  • the analog measurement requires 270 ⁇ s, the DFT signal processing takes 258 ⁇ s, resulting in a measurement time of less than 0.6 ms per capacitive node.
  • Prototypes of the enclosure were manufactured in a four layer thin-film technology. Within an area of 144mmx 70mm, they contain 16 TX and 16 RX electrodes, whereas each TX-RX combination has 990 track overlaps. Due to the differential readout this yields 128 differential PUF nodes.
  • the integrity verification detects shorted and interrupted electrodes correctly.
  • the PUF measurement circuit extracts the differential capacitance variation from the enclosure foil. Exemplary results for the extracted ⁇ C after early preprocessing are depicted in Fig. 14 .
  • Each data point represents one differential capacitive PUF node.
  • the first 16 data points show RX1 to RX16 excited by the first TX pair TX1-TX2.
  • the plot continues with RX1 to RX16 excited by TX3-TX4 until RX1 to RX16 excited by TX15-TX16.
  • the data of each TX group has a mean value of zero, since TX group offsets are removed during preprocessing.
  • the highlighted column shows the successful detection of a defect in the TX3-TX4 electrode pair. This demonstrates that both features, the integrity verification as well as differential capacitance measurement work correctly.
  • Embodiments of the second aspect refer to a differential measurement concept for capacitive PUF-based security enclosures whose parasitic capacitances are orders of magnitude larger than the PUF variation.
  • the embodiments refer to a scalable circuit design enabling enclosure integrity verification as well as capacitive PUF measurement in the range of milliseconds. Further, embodiments refer to a proof-of-concept implementation of the proposed circuit and practical verification using an enclosure prototype. Due to the high complexity of the overall system, example descriptions are sometimes limited in view of a number of measurement components, wherein other components such as key generation and enclosure design are not included in detail.
  • a differential capacitive measurement inside the enclosure is performed by applying stimulus signals with 180° phase-shift that isolate the local manufacturing variation in the femtofarads range.
  • the analog circuitry an corresponding digital signal-processing chain, using a microcontroller-based digital lock-in amplifier, perform precise PUF digitalization.
  • the system's measurement range may be approximately ⁇ 73 fF in embodiments, wherein this shall not limit the invention described herein.
  • the conversion time per PUF node may be less than 0.6 ms and the raw data may show a measured noise of 0.3 fF. This may be a base for a high-entropy key generation while enabling a short system's data time.
  • the circuit is scalable to the enclosure size and may experimentally verify to extract information from 128 PUF nodes, using a circuit prototype.
  • a two-layered mesh may contain orthogonally routed electrodes (conductive traces). They may serve as dual-purpose, as they are checked for integrity and are evaluated as PUF at the same time.
  • the PUF behavior may be contained in the variation of capacitive coupling between electrodes in the enclosure. PUF property extraction may be challenging since the capacitance variation lies within the range of only several femtofarads while parasitic capacitances of hundreds of pico-farads are present. This may be solved by differentially evaluating the electric capacitances. Furthermore, the influence of the measurement circuit on the PUF may be minimized in embodiments.
  • the system may use a specialized measurement circuit which can extract the PUF property precisely and may also verify the mesh integrity. Both measurements may be interlocked to obtain a secure system.
  • the PUF may prevent simple jumper attacks, as additional wiring will have non-negligible impact on the PUF property.
  • the integrity verification prevents an attacker from splitting off regions of the capacitive PUF. While there are concepts for integrity verification as well as for capacitive PUF sensing in known concepts, embodiments provide for a combination thereof.
  • the third aspect of the present invention is directed to obtaining a reliable measurement and to protect devices with PUF films and apparatus according to embodiments.
  • Known tamper-resistant enclosures and envelopes are battery-backed envelopes that enclose the system and thereby protect it from tampering [2].
  • the aforementioned battery-backed envelope is made of a flexible polymer with a printed conductive mesh. Additionally, it is potted using an opaque resin with the following properties: difficult to penetrate and to remove, either mechanically or using solvents.
  • the mesh serves as a resistive sensor which is continuously evaluated.
  • the mesh tracks are routed on multiple layers in a serpentine pattern with no visible gaps such that penetrating the mesh very likely causes a detectable change which triggers the zeroization, i.e., countermeasures of the apparatus which may include a deletion of memory content. Due to the wrapping of the envelope, this mesh obstructs any possible angle of an attack. Additionally, its tracks are invisible to optical inspection or x-rays and a device-specific layout randomization further increases the difficulty of attacks.
  • the monitoring circuit is preferably armed at the factory and supplied by the battery throughout the product lifetime including its shipping. This is unfavorable since environmental conditions during transport often exceed those of the intended operating environment in terms of peak temperature, vibration, etc.
  • the actively running battery-backed monitoring circuit is subject to these conditions and as a result is more likely to cause false alarms. After arrival, maintaining the battery is necessary [8].
  • Another approach measures the difference in fringe-effect capacitances of the enclosure due to intruding objects [3].
  • PUFs which offer a hardware-intrinsic key storage without a dedicated memory for the key [19], [10]. They make use of random variations of manufactured structures to derive an individual behavior for each device. In order to harness the PUF properties, these variations have to be extracted. They are similar for each read-out of the same device but subject to noise and also affected by environmental changes.
  • PUFs Secure key derivation with PUFs is a common use case [20].
  • the key is derived for the first time and discarded after helper data is created and stored, to enable later error-correction.
  • helper data and the noisy PUF response are combined to derive the initial secret.
  • PUFs can be integrated into IC designs, but they typically only offer limited tamper-resistance [12], especially for other system components. Therefore, it is focused on non-silicon PUFs in the following.
  • Coating PUF [21] that protects an IC by covering its top with a randomized coating material, which is measured to extract its unique properties and derive a secret key. Reconstructing this key is infeasible if the coating has been damaged due to an attack.
  • a similar approach using an optical PUF is presented in [22]. Both approaches do not address attacks during runtime. Furthermore, covering every IC of an embedded device with a coating requires a costly, fully customized sourcing of its components. Moreover, access to the PCB would still be possible and therefore simplify various attacks, e.g., voltage glitch or side-channel attacks.
  • Vai et al. Based on the requirement to protect a system as a whole, Vai et al. present an optical waveguide coating PUF [23] with a corresponding system architecture in [24]. As the waveguide only covers the top of a PCB, its edges and bottom remain unprotected. Moreover, such a system can be attacked during runtime to extract keys in volatile memory. Therefore, implementing a runtime tamper detection that monitors the system after power-on is vital to detect possible tampering attempts. This is not mentioned in [24].
  • the enclosure traces may be manufactured from a material of non-zero ohmic resistance that may influence the result of the differential or non-differential capacitance measurement. Therefore it may be advisable for the system not only to use the capacitive measurement result for key derivation but the measured complex impedance, also containing information about the resistive properties of the enclosure.
  • the evaluation unit may be able to conduct a third measurement that yields the mutual/absolute capacitance of a TX to RX combination. This is not a differential measurement, thus, the resulting capacitance is, for example, C 11 in Fig. 7b .
  • the evaluation unit can measure any TX to any RX combination from C11 to C22 according to the example envelope in Fig. 7b .
  • the evaluation unit outputs, by way of example, only a single TX signal which is a sine wave of 33.3 kHz but with reduced amplitude.
  • Fig. 15 shows a schematic perspective view of a PUF-film 150 according to an embodiment of the third aspect.
  • the PUF-film 150 comprises circuit elements 152 1 to 152 3 arranged so as to form a flat circuit structure 154 which may be incorporated, at least partially, in the PUF-carrier 52 which may comprise, as described in connection with the second aspect, one or more granule materials.
  • An example granule material may be, for example, a dielectric material such as TiO 2 , TiN or the like.
  • the granule material may comprise particles as they are used for coating PUF.
  • a first granule material may comprise a dielectric constant of ⁇ 1 and a second granule material may comprise a dielectric constant of ⁇ 2 .
  • ⁇ 1 may be a multiple of ⁇ 2 and the share of particles comprising ⁇ 2 may be lower when compared to the share of particles having ⁇ 1 . This may allow for a locally varying mixing ratio and to a local strongly varying capacitance variation and therefore to a high entropy.
  • the dielectric layer 28 may cover the conductive trace layer, the structured electrode layer 32 partially so as to leave the region 44 uncovered from the dielectric layer 28.
  • Conductive traces of the trace layers 32 1 and 32 2 may be galvanically connected or coupled in the region 44 due to the traces of the structured electrode layer 32 1 extending beyond the edge of the dielectric layer 28.
  • the circuit structure 154 being a flat circuit structure may be understood as comprising a flat or aerial extension, for example, an extension along directions x and directions y being at least 10 times or at least 100 times larger when compared to the thickness direction, indicated as z.
  • the flat circuit structure 154 may be formed as the circuit structure 54, 54a, 54b or 54c.
  • the PUF-film 150 further comprises the shield 62 being formed as a flat electric shield.
  • the shield 62 formed as a flat shield is understood as covering an area of the flat circuit structure 154, i.e., being flat a same was as described for the flat circuit structure 154.
  • Being flat may refer to as being arranged in one layer, wherein the layer is not limited to be only two-dimensional but may also bend.
  • the circuit structure is evaluable with respect to the plurality of electric capacitance values 34 1,2 and/or 34 2,3 being arranged between the plurality of circuit elements 152 1 to 152 3 that may be formed as the conductive traces 26.
  • the electric shield 62 at least partially covers the circuit structure 154, preferably in a large area and more preferably at least in a sensoric region and provides for a common reference electrode of the plurality of electric capacitance values.
  • the plurality of circuit elements 152 may further be evaluable with respect to a resistance value as described in connection with Fig. 6a . Such an embodiment may be understood as the PUF-film 60 being combined with the shield 62.
  • the shield 62 may be arranged at the PUF-carrier 52 prior to attaching the PUF-film 150 to a device to be protected.
  • the shield 62 may be formed as a metallic layer, e.g., as a film or foil or the like.
  • the shield 62 is at least partially formed as a metallic mesh allowing for a high flexibility when wrapping the PUF-film 150 around a housing or case of a device to be protected.
  • the shield 62 may also be arranged afterwards.
  • the conductive foil or conductive mesh may be arranged after having wrapped the foil around the housing.
  • the shield 62 may be a sprayed conductive layer, i.e., may be formed by spraying or vaporizing, i.e., generating, the conductive layer 62 after having wrapped the PUF-film around the housing.
  • one or more of the shielding layers, in particular an outer shield may be generated after having wrapped the PUF-film around a device to be protected, e.g., a housing.
  • embodiments cover both, i.e., a PUF-film 150 having already the shield 62 and being extended by a sprayed layer.
  • Fig. 16a shows a schematic side view of a PUF-film 160 that may be produced with a method according to the first aspect and such as the PUF-film 150.
  • the PUF-film 160 comprises a shield layer 62 1 covering the film substrate 24 1 carrying the conductive traces 26 1 to 26 7 .
  • the substrate may be provided so as to already comprise the shielding and/or the conductive traces.
  • the shielding may also be arranged afterwards and/or the conductive traces 26 1 to 26 7 may be arranged onto the film substrate 24 1 prior to printing the dielectric layer 28.
  • the dielectric layer 28 comprises a first granule material 156 and a second granule material 158, wherein the granule materials 156 and 158 may vary when compared to a dielectric constant, a temperature coefficient, a resistance value and/or a density or the like.
  • the granule materials 156 and/or 158 may be arranged in a stochastic distribution so as to influence the plurality of electric capacitance values.
  • a filling layer 164 may be arranged, for example, using a printing process.
  • the filling layer 164 may comprise dielectric material which may be, for example, a same material as the dielectric layer with or without the granule material or may be a different material.
  • the filling layer 164 allows for obtaining a plane surface of the layer stack.
  • a further film substrate layer 24 2 may be arranged on a side 164A of the filling layer 164, the side 164A opposing the structured electrode layer 32 1 .
  • the film substrate layer 24 2 may be a same or a different material when compared to the film substrate 24 1 and may serve as a spacer between a further shielding layer 62 2 arranged on a side 24 2 A of the film substrate 24 2 opposing the filling layer 164.
  • the filling layer 164 in combination with the substrate 24 2 may allow for generating a distance h 1 between the structured electrode layer 32 1 and the shielding layer 62 2 being, within a tolerance range of at most 30%, at most 20% or at most 10%, equal to a distance h 2 between the conductive traces, e.g., 26 1 and the shielding layer 62 1 .
  • the rough or uneven structure of the structured electrode layer 32 1 may prevent a complete equilibrium between the distances h 1 and h 2 by approximating such a condition with the filling layer 164 being as thin as possible whilst generating an even surface and the film substrates 24 1 and 24 2 comprising a same thickness may allow for almost symmetrically shielding the capacitance values of the PUF-film.
  • the circuit elements i.e., the structured electrode layer 32 1 and/or the structured electrode layer 32 2 may be covered at least partially with a material being opaque in a visible wavelength range and/or in an x-ray wavelength range.
  • a material may be directly deposited on the respective structured electrode layer 32 1 and/or 32 2 on one or both sides thereof but may also be different and possibly contactless with respect to the structured electrode 32 1 and/or 32 2 layer within the layer stack.
  • An example material may be an opaque polymer material, an opaque glass material, a semiconductor material or the like.
  • a polymer material such as a carbon material such as a carbon paste may be arranged in the PUF-film and forming one or more layers thereof.
  • Carbon material may be opaque as well in the visible wavelength range of, for example, 380 nm to 780 nm and the x-ray wavelength range ranging from, for example, 1 pm to 10 nm.
  • a conductive material may be used, for example, a silver paste or the like. Silver paste may allow for an opaqueness but may be formed conductive based on the degree of filling of the silver in the paste.
  • the opaque material may comprise PEDOT/PSS, inks comprising carbon nanotubes or the like as well as thin metal layers
  • the material being referred to as opaque material may be alternatively or in addition be formed so as to comprise a within a tolerance range of 10 %, 5 % or 2 % a same absorption coefficient when compared to the conductive traces and/or the shield at least in the relevant optical regions such as X-ray and/or visible wavelength.
  • This generates a kind of opaqueness as the traces, shielding and the rest may form a homogenous area hampering diversification of structures. The traces thus become invisible.
  • the opaque material may be one or more of the layers 24 1 , 164 and/or 24 2 and/or may be an additional layer between the shielding 62 1 and 62 2 or outside thereof.
  • the opaque material may be arranged outside a range sandwiched between the shielding layers 62 1 and 62 2 and may again be covered with a further shielding being a mesh and/or a sprayed layer.
  • the layer 164 may be formed so as to comprise the thickness h 1 .
  • the advantage of interconnecting two different structured electrode layers 32 1 and 322 over a material edge of the dielectric layer 28 may also be used in embodiments of the third aspect.
  • the plurality of capacitance values may be arranged at least partially in an overlap area of conductive traces arranged in different conductive trace layers and overlapping with each other.
  • an arrangement of the conductive traces of the PUF-films 150 and/or 160 may be so as to allow for a condition where conductive traces arranged in a first trace layer (first structured electrode layer) and conductive traces arranged in a second trace layer (second structured electrode layer) are arranged in an interleaved manner such that at least one, a plurality thereof or each conductive trace is exclusively neighbored by a different conductive trace along an actual course of the trace.
  • the PUF-films 150 and/or 160 may be configured so as to allow an evaluation of the structured electrode layers, the conductive traces thereof respectively with respect to electric capacitance values arranged there between and electric resistance values thereof.
  • Further layers possibly having at least one additional granule material may be arranged between the conductive trace and the adjacent or juxtaposed shield or outside the overlapping regions so as to further adapt the capacitance measured between the structured electrode layers.
  • Fig. 16b shows a schematic side view of a PUF-film 160' corresponding to the PUF-film 160 with exception of an absence of the granule material.
  • a further first region 42 2 may be arranged in which the dielectric layer 28 is printed such that the second region 44 forms a hole or recess in the dielectric layer 28.
  • Fig. 16c shows a schematic side view of a PUF-film 160" comprising a possibly unshielded PUF-film according to an embodiment such as the PUF-film 20 or 60, 60'.
  • the PUF-film 20 may be covered on both main sides with a dielectric material 157 1 and 157 2 which may comprise same or different dielectric materials.
  • the dielectric layers 157 1 and /or 157 2 may optionally serve as an adhesive layer for adhering conductive layers 159 1 and/or 159 2 , e.g., a metallic mesh or film. Both, the dielectric layer 157 1 and the conductive layer 159 1 may form the shield 62 1 .
  • the dielectric layer 157 2 and the conductive layer 159 2 may form the shield 62 2 .
  • the shields 62 1 and/or 62 2 may be formed differently, e.g., by an adhesive conductive paste a varnish/lacquer or the like.
  • one of the shields 62 1 or 62 2 may be absent in embodiments of the third aspect. Both may be absent in the first and second aspect.
  • a metallic housing to be covered with a PUF-film of the described embodiments may allow for use thereof as one of the shields such that a use of only one shielding layer allows a shielding from both sides.
  • Fig. 17 shows a schematic block diagram of a PUF-film 170 according to an embodiment of the third aspect.
  • the PUF-film 170 comprises capacitive elements 166 1 and 166 2 electrically coupled between two circuit elements 152 1 and 152 2 , 152 2 and 152 3 , respectively.
  • the capacitive elements 166 may be, for example, capacitor elements. They may be galvanically coupled between the respective circuit elements 152 and may allow for obtaining an additional capacitive value. Although being probably deterministic, this may allow for an easy integrity check using a (same) capacitance measurement during operation of the PUF-film.
  • a damage or cut in one of the circuit elements 152 may easily be detected because of a large variation in the capacitance value between two circuit elements 152 being connected to each other by one or more of the capacitive elements 166.
  • the additional capacitor elements 166 1 and/or 166 2 may, preferably, be arranged close to ends (regions TX/RX and TXR/RXR) of the conductive traces/electrodes. I.e., at least two capacitive elements may be arranged between two adjacent traces. This allows for an unbalancing of the measured capacitance value when disrupting the conductive or an adjacent conductive trace.
  • Fig. 18 shows a schematic top view on a PUF-film 180 according to an embodiment of the third aspect.
  • the PUF-film 180 comprises the circuit elements 152, wherein a number of B circuit elements 152 1 to 152 B is arranged in the PUF-film 180.
  • the PUF-film 168 may comprise an interconnecting circuit 168 being configured for providing a programmable, changeable, and/or multiplexing connection between connected lines. Such a configuration or programming may be obtained during manufacturing, e.g., the circuit may be factory-configurable, e.g., an FPGA.
  • the interconnecting circuit 168 may be configured for connecting and/or multiplexing connecting lines 172 1 to 172 A to the circuit elements 152 1 to 152 B .
  • the connecting lines 172 may be connectable with an evaluation unit for operating the PUF-film 180.
  • an evaluation unit for operating the PUF-film 180.
  • the interconnecting circuit may be adaptable or programmable for, at least between different PUF-film, variably generate a series of conductive traces such that by identifying, bypassing or corrupting one of the traces, e.g., at the controller PIN, a location or position of the trace in the PUF-film is still unknown.
  • the interconnecting circuit 168 may allow for a further randomization and/or for an increased security, i.e., for a layout randomization.
  • the interconnecting circuit 168 may connect the connecting lines 172 1 to 172 A 1:1 to a subset of the circuit elements 152 1 to 152 B so as to operate only the connected subset of circuit elements 152. Based on randomness, it may be unknown to the attacker, which lines are operated and which are not operated so as to allow for a high security.
  • the interconnecting circuit 168 may connect one of the interconnecting lines 172 to two or more of the circuit elements with a ratio of 1:n so as operate the n circuit elements 152 in parallel.
  • the interconnecting circuit 168 may interconnect two or more of the circuit elements 152 so as to form a single operated circuit element, e.g., by operating a plurality of n circuit elements 152 serially with one interconnecting line 172. This may allow for increasing a number of traces 152 when compared to a number of pins used for connecting the PUF-film.
  • the interconnecting circuit 168 may also be referred to as a security sensor enhancing security of the PUF-film.
  • the interconnecting circuit 168 may alternatively or in addition to providing for the aforementioned layout randomization and according to an embodiment, provide for one or more functionalities of an evaluation unit described in connection with present embodiments.
  • the interconnecting circuit 168 may comprise an integrated circuit structure and may allow for embedding functionality into the PUF-film by embedding the interconnecting circuit 168 into the PUF-film.
  • the interconnecting circuit may be configured for monitoring the circuit structures and may receive, from a device, electrical power and may provide for alarm signals.
  • the interconnecting circuit providing for the layout randomization and an additional embedded chip providing for at least a part of a functionality of the evaluation unit may be embedded into the PUF-film, probably outside the sensoric region, as two distinct components.
  • Fig. 19a shows a schematic block diagram of an apparatus 190 according to an embodiment of the third aspect.
  • the apparatus 190 comprises the PUF- film 150 wherein alternatively or in addition other films according to the third aspect may be arranged, such as the PUF-film 160, 170 and/or 180.
  • the embodiments of the third aspect are combinable, without any limitation with the PUF-films of the second aspects, wherein the embodiments of the second and third aspect may be produced with embodiments of the first aspect.
  • the apparatus 190 comprises an evaluation unit 174 configured for differentially evaluating the plurality of electric capacitance values based on antiphasic excitation of neighbored circuit elements as well as the verification of trace integrity and an optional absolute capacitance measurement.
  • the antiphasic excitation and/or different features may be implemented as described in connection with the second aspect.
  • the evaluation unit 174 is the evaluation unit 78.
  • the evaluation unit 174 is configured for antiphasically exciting a first circuit element such as the circuit element 152 1 and a second circuit element such as the circuit element 152 2 of the plurality of circuit elements 152 at an instance of time and for not exciting a third circuit element such as the circuit element 152 3 of the plurality of circuit elements at the instance of time.
  • this may be understood as exciting the traces 26 1 and 26 2 corresponding to circuit elements 152 1 and 152 2 for example, at the instance of time while not exciting further traces indicated by "TX3/TX3R" and "TX4/TX4R".
  • the evaluation unit may sequentially excite subsets of circuit elements while not exciting others so as to perform undistorted measurements of the capacitance values.
  • Fig. 19b shows a schematic block diagram of an apparatus 190' according to an embodiment for illustrating a concept of the interconnecting circuit 168.
  • the apparatus 190' may comprise an evaluation unit for evaluating a circuit structure such as a circuit structure incorporated in a PUF-film such as the PUF-film 170 or a different PUF-film of the first, second and/or third aspect.
  • the evaluation unit 174 may be arranged or a different evaluation unit.
  • the evaluation unit may comprise a set of contact ports 175 1 to 175 4 such as pins which may be connected with the conductive traces, e.g., the conductive traces 152 1 to 152 4 .
  • Each trace 152 i may comprise a first end i and a second end iR.
  • the interconnecting circuit may be used for a layout randomization and may comprise a first configuration in Fig. 19b .
  • the interconnecting circuit 168 may comprise for a variable, i.e., at least once adjustable, interconnection between the contact ports 175 and the conductive traces 152.
  • the contact port 175 1 may be electrically connected to the end 1
  • the contact port 175 2 may be electrically connected to the end 2
  • the contact port 175 3 may be electrically connected to the end 3R
  • the contact port 175 4 may be electrically connected to the end 4R.
  • the interconnecting circuit 168 may provide for a variable, i.e., at least once adjustable, interconnection between the ends. In the shown first configuration, ends 1R and 3 and ends 2R and 4 may be interconnected.
  • Fig. 19c shows a schematic block diagram of the apparatus 190' in a second configuration of the interconnecting circuit 168 according to an embodiment.
  • the contact port 175 1 may be electrically connected to the end 1
  • the contact port 175 2 may be electrically connected to the end 2R
  • the contact port 175 3 may be electrically connected to the end 3
  • the contact port 175 4 may be electrically connected to the end 4R.
  • the interconnecting circuit 168 may provide for a variable, i.e., at least once adjustable, interconnection between the ends.
  • ends 1R and 2 and ends 3R and 4 may be interconnected. Thereby, by having gained access to an end of a conductive trace, an association thereof to a contact port is still secret and/or by having gained access to a contact port, its corresponding position in the PUF-film is still secret.
  • the interconnecting circuit 168 may be a component distinct from the evaluation unit 174.
  • the evaluation unit 174 may at least partially be implemented by the interconnecting circuit 168 and be embedded in the PUF-film.
  • Fig. 20 shows a schematic block diagram of an apparatus 200 according to an embodiment of the third aspect, wherein the description refers, without any limitation to embodiments of the second aspect.
  • the apparatus 200 comprises, for example, the PUF-film 40 having a sensoric region 176 being defined by the overlaps of the conductive traces as described in connection with Fig. 8a .
  • the PUF-film 40 may be used as an envelope so as to enclose a host system 178 having, for example, a housing or the like.
  • the apparatus 200 comprises an evaluation unit 182 which may implement, amongst other things, the functionality of the evaluation unit 78 and/or 174.
  • the PUF-film 40 may be connectable to the evaluation unit 182 by use of a connector 184.
  • the connector 184 may comprise the lines of the PUF-film 40 having the conductive traces arranged as a fine mesh in the sensoric region in a common plane as described in connection with Fig. 8a .
  • the evaluation unit may also be connected to the PUF-film 40 without connector, i.e., fixed, e.g., using a soldering process.
  • every other PUF-film according to the embodiments described herein may be used in apparatus 200.
  • the evaluation unit 182 may be implemented for performing a capacitance measurement 186, for example, by performing the differential measurement. Further, the evaluation unit 182 may be configured for performing integrity detection 188, for example, by monitoring the resistance values of the conductive traces and/or by monitoring the capacitance values there between, e.g., as described in connection with Fig. 17 .
  • Capacitive measurement 186 and integrity detection 188 may be performed, for example, in the analog domain 88, wherein the subsequent processing may be performed, at least partially, in the digital domain 86. Conversion from the analog domain 88 to the digital domain 86 may be obtained by use of the ADC 116.
  • the evaluation unit 182 may be configured for performing a signal processing 192 being a basis for a subsequent key generating 194, e.g., by processing the results of the capacitance measurement 186.
  • Signal processing 192 may further be a basis for a tamper detection 196, for example, by evaluating changes in the capacitances obtained by the capacitance measurement 186 and/or by results obtained by the integrity detection 188.
  • a key 195 derived in the key generation 194 and/or a result 197 of the tamper detection 196 may be evaluated in a unit 198 for generating an alarm, heartbeat and/or instructing a zeroization.
  • the unit 198 may be, for example, a watchdog transmitting, for example, a heartbeat-signal 202 to the host system 178, wherein the heartbeat-signal 202 may signalize that everything is ok or may signalize that an alarm is generated, i.e., that tampering is detected.
  • zero-dead or zero-alive signals may be used and may be interpreted as the signal is transmitted when everything is ok or that the signal is transmitted when tampering is detected.
  • the key 195 may be supplied to the host system 178, for example, for firmware decryption or decrypting other data stored in a memory of the host system 178.
  • the host system 178 may also monitor one or more Critical Security Parameters (CSPs) 206 and/or may actively or passively perform zeroization 208, i.e., may delete at least unencrypted data and/or other, possibly encrypted data.
  • CSPs Critical Security Parameters
  • the sensoric region 176 may enclose both, the evaluation unit 182 and the host system 178.
  • the evaluation unit 182 may be arranged in the same housing as the host system 178 and/or may be implemented in the same processing unit.
  • the capacitive sensors of the envelope act as a PUF and provide the basis for a cryptographic key.
  • the same key can only be extracted if the envelope has not been tampered with. While manufacturing the device, this key is used as key-encryption-key (KEK) to encrypt and authenticate CSPs or other sensitive data of the enclosed device.
  • KEK key-encryption-key
  • the thusly protected data is stored in non-volatile memory, since an attacker can neither gain information from it nor change it in a useful way without damaging the envelope, thereby destroying its key.
  • the system Upon power-on, the system self-authenticates and is decrypted. Once the device is running, the same sensors that extracted the PUF properties from the envelope now continuously monitor it. In case of an attack during runtime, an alarm is raised to trigger the zeroization of sensitive data which is temporarily stored in volatile memory for processing it. Alternatively or in addition, the alarm may be used for deactivating specific parts or functions of the device, such as parts for operating on data to be secured. I.e., the evaluation unit may be configured for deleting data or for deactivating a function of the device in case of detecting altering of the circuit structure and/or the PUF-film.
  • the evaluation unit may be configured for providing at least a first alarm signal and a second alarm signal in case of having detected a tampering.
  • the first alarm signal and the second alarm signal may comprise the same information, i.e., allowing for distinguishing between a first case in which no tampering is detected and a second case in which tampering is detected but may encode this information differently so as to hamper and attempt for imitating a respective signal, e.g., by overwriting the original signal on the signal lines.
  • the first alarm signal may provide for a first sequence or continuous amplitude, e.g., a specific voltage on a pin of the controller in the first case and may switch to a different amplitude (including zero voltage) in the second case thereby indicating the alarm.
  • the second alarm signal may provide for a probably random sequence of potentials in the first case and may change the sequence or may deactivate the sequence in the second case, thereby indicating the alarm. A change in one of both signals may indicate the second case and may therefore cause the device and/or evaluation unit to trigger countermeasures.
  • At least one dynamic and/or one static may thus allow for a high security, in particular when, as in accordance with embodiments, the apparatus determines a duty cycle and/or a different parameter of at least one of the signals being thus a priori unknown to an attacker.
  • the parameter may be determined, for example, during each start up differently.
  • the device may be configured, for example, to deactivate one or more functional blocks, elements, circuitries or other power consuming parts at least temporarily so as to save electrical energy.
  • the saved electrical energy may be used for extending or to lengthen a runtime of the device, e.g., when power supply lines are attacked.
  • analogue components including components for measuring the integrity of the PUF film may be deactivated.
  • the saved energy may be used for a probably digital deletion/zeroization such that a high amount of data may be erased based on deactivation of power consuming functional blocks.
  • the device and/or evaluation unit may be configured for unpowering/deactivating at least functional block or circuitry, preferably an analogue circuitry so as to save electrical power and to use the saved electrical power for zeroization, i.e., for deleting data.
  • the envelope is comprised of a foil containing a mesh of fine conductive tracks.
  • the mesh represents the PUF to derive a cryptographic key by evaluating the capacitance measurements over the entire sensoric region. It also acts as an opaque barrier around the fully enclosed device.
  • the envelope's sensoric region contains overlapping tracks that represent the electrodes which work as capacitive sensors. These tracks are subject to manufacturing variations in terms of surface roughness and physical dimension due to etching. As a result, each overlap between the electrodes represents a capacitance that cannot be accurately predetermined.
  • the evaluation unit connects the envelope to the host system and comprises the following domains and units:
  • the host decrypts the firmware or additional CSPs using the key derived from the envelope. Once running, direct access to the key is denied to prevent software-based extraction. If the alarm signals indicate a tampering attempt, a zeroization is carried out. Following this generic approach, it is possible to implement a wide range of applications that may be unaware of their physically protected execution environment.
  • Fig. 21 shows a schematic perspective view of an apparatus 210 according to an embodiment of the third aspect and/or the second aspect.
  • a host system comprising a printed circuit board (PCB) 214 in a housing or internal casing 216 is enclosed by a PUF-film according to an embodiment, wherein the evaluation unit 182 may be connected with the PUF-film using the connector 184.
  • the PUF-film may comprise two layers of structured electrodes 32 1 and 32 2 , overlapping with each other so as to form a sensoric region.
  • the structured electrode layers 32 1 and 32 2 may be sandwiched between a first shield 62 1 and a second shield 62 2 .
  • Apparatus 210 may comprise a potting resin 218 covering the PUF-film, wherein the potting resin 218 may also be a part of the PUF-film, for example, one of the outer layers or the outermost layer.
  • the potting resin may be, for example, a carbon paste.
  • the shielding 62 2 may also cover the potting layer 218.
  • a supply and/or communication cable 222 may allow for communicating with the host system and/or for powering it externally.
  • the host system may comprise a secure communication interface preventing an exchange unencrypted data.
  • the sensor region completely covers the housing 216 so as to avoid any regions suited for an attack.
  • a self-contained capacitive sensor is comprised of two electrodes, "Tx” and "Rx” This terminology is borrowed from the domain of capacitive touch technology.
  • the "Tx” electrodes are driven by an excitation signal and the "Rx” electrodes act as receivers. This is quantified as the “mutual capacitance” between Tx and Rx (as illustrated in table 1).
  • the capacitive measurement is to be protected against interference from inside the device and its environment. Therefore, the two layers of electrodes are enclosed with a grounded shield on top and bottom to provide a well-defined boundary condition. Since the parasitic capacitance towards the shield will be rather large compared to the mutual capacitance, partially removing the shield already significantly degrades the measurement.
  • a sensor layout may be manufactured with a structure size of 100 ⁇ m line and space as shown in Fig. 22a-22c i.e., 3 ⁇ 100 ⁇ m ⁇ 300 ⁇ m.
  • Creating small structures increases the difficulty of attacks and improves manufacturing variations.
  • the structure size is small, contamination during manufacturing is possible, resulting in short circuits.
  • some manufacturing steps may break electrode tracks, resulting in open circuits.
  • both effects sometimes occur as shown in Fig. 22b and Fig. 22c .
  • Fig. 8a allows checking the electrode's continuity by forming a loop, i.e., both input and output of an electrode are routed to the connector, denoted as Ri/Ro for Rx and Ti/To for Tx electrodes.
  • the electrodes are interleaved such that each neighboring track can be driven independently.
  • Figs. 8a and 8b shows the resulting advanced layout and its various representations, which can easily be scaled to cover a larger area by increasing the number of windings and/or electrodes.
  • the capacitance C s of a single sensor node (as illustrated in Fig. 8b ) is analyzed based on its simplified equivalent circuit in Fig. 23a and Fig. 23b .
  • Each of the n overlaps (sensor cells) between the electrode tracks represents a tiny capacitor in parallel.
  • C s is therefore the sum over the capacitances C c,i .
  • This representation is simplified since it ignores the resistance in series between each sensor cell. However, as long as track resistance is matched, this is a valid initial estimate based on our practical experience.
  • ⁇ M 1 fF ⁇ C c is selected for measuring the capacitances is only a first step.
  • C N is the nominal capacitance
  • C V the variation from the manufacturing process.
  • One goal of selecting a measurement technique is to optimize its sensitivity towards C V . This is mainly controlled by two parameters: first by the number of steps the capacitance measurement system resolves, expressed by Effective Number of Bits (ENOB), 2 ENOB secondly by the maximum of the capacitance, denoted as C max .
  • ENOB Effective Number of Bits
  • ⁇ C min C max 2 ENOB .
  • ENOB is assumed to be the constant and C max may be analyzed in more detail.
  • ⁇ C min primarily depends on C N which leads to ⁇ C min > C V for even a small number of sensor cells, as C N increases linearly in the n, while the variation increases by n ⁇ ⁇ c . Thus no variation could be measured.
  • the electrodes TX i-1 and TX i are routed differentially. They form the TX pair (TX 2k-1 , TX 2k ), for k ⁇ ⁇ 1, 2...., N TX /2 ⁇ .
  • Fig. 25 is a schematic flowchart of an operation of an apparatus according to an embodiment such as apparatus 200.
  • TD-A Tamper Detection A
  • TD-B2 limits the discrete rate of change, i.e., by computing
  • the width of the interval is defined by the multiplication using y.
  • the probability that a value is within an interval may be derived from tables relating ro the Gaussian distribution.
  • the value Qw may be selected small, i.e., having a small width such that a high degree of entropy is extracted from the distribution. This may be combined with using an error correction later.
  • the heartbeat 202 may be interrupted (or alternatively generated).
  • Fig. 26a shows an example bottom view of an example PUF-foil according to an embodiment of the second and/or third aspect.
  • Fig. 26b illustrates a wrapping concept around a case that contains the protected module.
  • the shielding is not attached and the sensoric region 176 does not fully overlap in Fig. 26b as it is implemented in other embodiments.
  • the design properties of the example are:
  • the mesh is based on lithographic patterning to have a scalable technology that allows even smaller structures in the future: Using a reel-to-reel process with an infinite-length substrate, copper (Cu) may be deposited on the first electrode layer by sputtering on a polyimide (PI) substrate. Subsequently, this layer with Rx electrodes is reinforced by an additional semi-additive galvanic process, resulting in a Cu layer of 7 ⁇ m. This is done to have a defined stop interface while processing the blind vias in the PI substrate by laser ablation.
  • Cu copper
  • PI polyimide
  • the Tx layer is only sputtered, resulting in a Cu thickness of just 500 nm, while at the same time creating the conductive interconnection between the electrodes on both sides of the PI.
  • the carrier substrate with electrodes is enclosed in a shield on both sides.
  • the resulting height of the layer stack-up is approx. 200 ⁇ m, which is important for the flexibility when mounting the envelope.
  • Fig. 27a shows an example PDF of ⁇ and contains all sensor nodes from all envelopes.
  • an equidistant quantization may be selected for reasons of a uniform tamper-sensitivity across the measurement range [25]. Its bin size ⁇ Q is chosen as multiples of the noise deviation ⁇ N, thereby making the result more robust.
  • ⁇ Q 1.25 fF
  • the computed Shannon entropy yields 4.4 bit per node. Hence, a total of 128 ⁇ 4.4 bit ⁇ 560 bit can be expected from the PUF under ideal conditions.
  • an average error rate of ⁇ 0.1% per sensor node may be obtained after quantization at room temperature.
  • the number of quantization intervals may be lowered, causing the entropy to drop to 2.5 bit per node.
  • this typically results in less than 3 erroneous nodes (out of 128) over the range of -20°C to +60°C, i.e., in addition to the quantization, an error- correcting code is required.
  • a well-tailored choice is made by considering the result of each quantization interval as a symbol from a higher-order alphabet. Each symbol is then mapped to a variable-length bit sequence which necessitates the use of an insertion/deletion code as described in [28].
  • Fig. 27c To verify the tamper-evident properties of our enclosure, one of the envelopes was attacked using a 0.3 mm drill as shown in Fig. 27c . As guaranteed by the chosen structure size, one Tx and Rx electrode were destroyed, here, resulting in open-circuits of Tx13 and Rx10. Independent of the PUF- properties, this already allows the system to determine that an attack has taken place. Hence, to study the effects on the PUF, the integrity check first may be disabled. The resulting plot in Fig. 28 shows the difference of the capacitances from before and after the attack. As the Tx pair Tx13 and Tx14 is no longer balanced, a dramatic change for the whole group of nodes is observed.
  • such a capacitive structure may allow for a secure detection of a drilling attack.
  • a drilling attack in the sensoric region leads to the fact that a row/column out of the capacitive matrix is destroyed, as at least one TX-electrode and at least one RX-electrode will be cut.
  • the single overlap region in the matrix will be destroyed but a complete row or column will be destroyed leading to a destruction of in total 23 overlapping regions.
  • Probing Electrodes An attacker might try to probe electrodes directly to measure their capacitance. This requires access to all electrodes, as properly connecting unused ones is mandatory for the measurement. At the same time, the shield needs to be partially removed at multiple spots, causing the surrounding field to change, thereby falsifying the results. Moreover, even state-of-the-art micro probes [29] add a capacitive load of > 20 fF which exceeds the observed variation.
  • Embodiments of the third aspect present a battery-less tamper-resistant envelope, which contains a fine mesh of electrodes, and its complementary security concept.
  • An evaluation unit checks the integrity of the sensor mesh by detecting short and/or open circuits. Additionally, it measures the capacitances of the mesh. Once its preliminary integrity is confirmed, a cryptographic key may be derived from the capacitive measurements that represent a PUF, to decrypt and authenticate the firmware of the enclosed host system.
  • the battery-less tamper-resistant envelope verifies its integrity, for example, after powering-up similar to a tamper-evident PUF.
  • TD tamper detection
  • embodiments contain an advanced mesh concept to not only detect short and open circuits, but also to measure the capacitances between traces. This may be regarded as a basis to implement the tamper evident PUF and allows for a dual approach with more sensitive integrity checks and secret key derivation. Hence, recovery of the key is only possible from inside the system as long as the envelope as not been tampered with.
  • Embodiments of the first, second and third aspect therefore relate to a security architecture based on a hybrid envelope which combines properties of traditional tamper-responding envelopes with PUFs and extends their concept. Furthermore, embodiments relate to a stochastic model of the contained PUF to estimate its entropy and support its design process.
  • the third aspect also relates to protecting a case with a hull. This may include wrapping of a suitable foil, i.e., a PUF-film.
  • a suitable foil i.e., a PUF-film.
  • the structure described in connection with the second aspect and the third aspect may also be included into the housing of a host system, i.e., according to an embodiment, a housing may comprise the structured circuit layers having the dielectric material there between.
  • the PUF-film may be a side or a plurality of sides of a housing or may be the complete housing.
  • Such a case of a host system may comprise a flexible cover or a respective housing construction, having an integrated capacitive matrix of conductive traces.
  • the embodiments may refer to the section of physically securing embedded systems following diverse security standards such as FIPS 140-2, PCI-HSM, common criteria or the like.
  • FIPS 140-2 FIPS 140-2
  • PCI-HSM PCI-HSM
  • common criteria FIPS 140-2
  • the present embodiments relate to cases with PUF-structures enabling a battery-less operation of the device.
  • Embodiments refer to a variation or change of capacitive properties by uncontrollable behavior with respect to their local value and location variations of a composition of the dielectric layer and/or a thickness thereof, e.g., by inserting particles into the dielectric material, because due to manufacturing deviations, sometimes only low variations occur.
  • Embodiments enable to evaluate the variations and to hamper reparability of a damaged structure which would negatively affect the level of protection because, in known systems, the dominant part of the measurement value is a constant value being independent from manufacturing deviations.
  • a property being distinguishable from a capacitive property and which may allow for a unique (one or zero) integrity check is provided. This allows for an unambiguous determination during the manufacturing if the measured variation is based on the manufacturing deviation or if a manufacturing defect occurred.
  • Values to be measured and methods for measuring those values include, in particular a differential capacitive measurement, wherein alternatively or in addition a complex impedance may also be measured as well as other values. Furthermore, the absolute capacitive value may be measured.
  • Known resistance-based foils require a randomization of the layout so as to allow for a suitable level of protection. Such concepts are known for Physical Unclonable Functions.
  • Embodiments provide for a capacitive foil matrix being coactively evaluable and allowing for an additional detection of short-circuits or cuts of the traces so as to allow for an integrity check.
  • the conductive traces are formed so as to comprise a number of overlaps, wherein the number of overlaps or the equivalent of their overlapping areas and adjacent edges is balanced in the sense of a differential evaluation.
  • a PUF-foil may comprise a shielding. Materials of the shielding may be metallic or non-metallic, for example, a carbon paste.
  • embodiments may provide for PUF-films having a layer stack which has, at least in parts, printed materials such as the printed dielectric layer 28.
  • the dielectric layer comprises at least a first and a second granule material, wherein an average mixing ratio of the first and the second granule material in the dielectric material varies along a lateral direction of the dielectric layer.
  • Embodiments referred to an electrode layout, wherein at the beginning and at the end of an electrode, a further capacitive coupling may be generated, for example by inserting discrete capacitor elements. This allows for a behavior that a disruption of a conductive trace leads to significant differences in the capacitive portion of a measured complex impedance or in the capacitive value itself, because the electrode capacity is no longer balanced.
  • an additional randomization may be obtained by use of an additional security sensor, i.e., interconnecting circuit 168 so as to physically increase the number of electrodes in the foil artificially.
  • an additional security sensor i.e., interconnecting circuit 168 so as to physically increase the number of electrodes in the foil artificially.
  • a number of 64 TX electrodes and/or a number of 64 RX electrodes or a higher number may be obtained by using a lower number of pins at the evaluation unit.
  • Those electrodes may be connected with the security sensor and may be combined in one or more levels, for example, pair-wise, wherein this does not prevent to follow the other design rules according to embodiments, for example, the interleaved arrangement of electrodes.
  • this may allow to use 16 pins for each of the TX electrodes and the RX electrodes, wherein this may be achieved by using two interconnecting levels.
  • One or more of those levels may comprise a dynamic programmable pair-wise combination of electrodes so as to allow for a randomization of the layout. This allows for complicating it for the attacker performing a correct association of a position on the PUF-foil to attacked electrode, which hampers the attack additionally.
  • Embodiments allow implementation of a battery-less technique providing for an effective protection against attackers so as to substitute battery-buffered techniques.
  • Embodiments of the second and third aspect thus refer to a carrier having circuit structures with a complex impedance and/or an electric capacitance value being evaluable with respect to an integrity in view of short-circuit and/or an open-circuit.
  • PUF-foils according to embodiments may comprise two or more layers of electrodes and/or shielding layers.
  • a design rule according to embodiments is that traces of a same electrode (conductive trace) are separated from each other by at least different electrode.
  • the PUF-foil wrapped around a casing or the casing carrying the protective concept may be implemented such that the sensoric region covers the device to be protected completely at least once.
  • the device is covered on two sides, for example, an upper side and a lower side or any other different sides, completely.
  • unprotected surfaces may be covered with an additional structure having a complex impedance and/or electrically connecting the sides protected.
  • a system according to an embodiment may be configured for evaluating or monitoring a correct and untampered blocking or sealing at edges of the apparatus.
  • electrodes which are accessible at two regions/areas
  • electrodes may be accessible on a more than two regions so as to allow for a higher number of measurement values.
  • an apparatus is configured and/or a method is adapted so as to excite a group of electrodes (conductive traces) and analysis a system response on one or more electrodes of a different (disjunctive) group of electrodes.
  • the measurement system for evaluating the structured electrode layers may be part of the protective concept of the housing or may at least be fixedly connected therewith.
  • the measurement system i.e., an apparatus and/or a PUF-film may comprise a configurable interconnecting matrix such that conductive traces may be measured one with another in a random and/or configurable arrangement. Such embodiments are described in connection with the interconnecting circuit 168.
  • Some embodiments refer to a shielding using a conductive non-metal such as a carbon paste.
  • the shielding layer 62, 62 1 and/or 62 2 may be covered with a non-metal.
  • a fine mesh of conductive material such as copper may be arranged outside the stack.
  • the obtained stack may be covered by spraying a conductive varnish/lacquer.
  • An order of layers may be changeable, for example the carbon paste and then the conductive material may be arranged or first the shielding may be implemented by the conductive material and afterwards the carbon paste may be arranged.
  • the shielding may comprise, at least partially, the carbon paste.
  • carbon paste may comprise a local activity, the conductivity may be enhanced by using a mesh or the like.
  • a connection of the inner shielding with the housing of the HSM may be obtained by a flexible metal mesh or metal pillow/pad as known from EMC-sealings (electromagnetic compatibility). This may allow for an increased interconnection between the housing and the shielding by use of a low resistance.
  • Fig. 29 shows a schematic side view of an apparatus 290 in accordance with the third aspect.
  • the apparatus 290 comprises the housing 216 having an opening 226.
  • the PCB 214 may be arranged also carrying the evaluation unit 182 being connected to a PUF-film according to an embodiment, e.g., the PUF-film 150 by use of the connector 184.
  • the PUF-foil 150 may comprise different sections 228 1 to 228 17 arranged in a sequential order and allowing for an overlap one to another such that the sensoric region of the PUF-film 150 is present on each location of the housing 216 at least once.
  • an additional adhesive may be arranged so as to hamper or disable the removable of the PUF-film 150.
  • Fig. 30 shows a schematic top view of a PUF-foil 300 according to an embodiment comprising the functionality of one or more of the other embodiments described herein.
  • Fig. 30 is described so as to illustrate the concept of wrapping the PUF-film 300 around a case and insofar corresponds with apparatus 290.
  • a first section 228 1 is arranged in the PUF-film 300.
  • This section 228 1 may be outside the sensoric region and may thus be suitable for carrying or hosting additional circuitries such as the interconnecting circuit 168, sections 228 5 , 228 7 , 228 9 , 228 11 , 228 13 and 228 15 may form folding or wrapping edges.
  • edges may be arranged in parallel to a first direction y of the PUF-film 300.
  • the PUF-film may be folded or wrapped over perpendicular wrapping lines 234 1 and 234 2 .
  • the sensoric region 176 is enclosed by cross-hatched areas 236.
  • the enclosure 216 may completely be protected.
  • Fig. 31 shows a schematic side view of an apparatus 310 in accordance with the second or third aspect in which the PUF-film 150 is wrapped differently around the housing 216.
  • the overlap 232 is comparatively small so as to allow guiding of wiring 238, e.g., a flexible PCB (Flex PCB) between layers of the PUF-film. So as to avoid bending of the wiring 238 together with an increasing overlap 232, the overlap may also be small.
  • the wiring 238 may be the supply and communication cable 222.
  • Fig. 32 shows a schematic perspective view of an apparatus 320 according to an embodiment of the second or third aspect.
  • the housing 216 is covered by the PUF-film 150, wherein every other film described herein may be used.
  • the PUF-film 150 comprises, for example, the interconnecting circuit 168 so as to increase a number of conductive traces 152 when compared to a number of traces being controllable at the connector 184.
  • a cable 242 may interconnect the connector 184 with the interconnecting circuit 168.
  • Embodiments of the third aspect allow for detection of a tempering and for a temper-response.
  • aspects have been described in the context of an apparatus, it is clear that these aspects also represent a description of the corresponding method, where a block or device corresponds to a method step or a feature of a method step. Analogously, aspects described in the context of a method step also represent a description of a corresponding block or item or feature of a corresponding apparatus.
  • a further embodiment comprises a processing means, for example a computer, or a programmable logic device, configured to or adapted to perform one of the methods described herein.
  • a processing means for example a computer, or a programmable logic device, configured to or adapted to perform one of the methods described herein.
  • a further embodiment comprises a computer having installed thereon the computer program for performing one of the methods described herein.
  • a programmable logic device for example a field programmable gate array
  • a field programmable gate array may cooperate with a microprocessor in order to perform one of the methods described herein.
  • the methods are preferably performed by any hardware apparatus.

Claims (15)

  1. Verfahren (1000) zum Herstellen eines Physikalische-Unklonbare-Funktion(PUF)-Films, wobei das Verfahren folgende Schritte aufweist:
    Drucken (1010) einer Schicht (28) eines dielektrischen Materials auf ein Filmsubstrat (24) derart, dass eine variable Dicke der Schicht (28) durch das Drucken erhalten wird; und
    Anordnen (1020) einer strukturierten Elektrodenschicht (32) auf dem dielektrischen Material (28);
    derart, dass die strukturierte Elektrodenschicht (32) aufgrund der variablen Dicke in Bezug auf einen elektrischen Messwert beeinflusst wird.
  2. Verfahren gemäß Anspruch 1, bei dem der elektrische Messwert entweder einen elektrischen Kapazitätswert, einen elektrischen Impedanzwert, einen elektrischen Widerstandswert oder einen elektrischen Induktivitätswert aufweist.
  3. Verfahren gemäß Anspruch 1 oder 2, bei dem das Drucken der Schicht eines dielektrischen Materials derart ausgeführt wird, dass eine relative Position eines Oberflächenprofils der dielektrischen Schicht (28) in Bezug auf die strukturierte Elektrodenschicht (32) einer stochastischen Verteilung unterliegt.
  4. Verfahren gemäß einem der vorhergehenden Ansprüche, bei dem das dielektrische Material zumindest ein Granulatmaterial (158) aufweist, wobei das Granulatmaterial (158) im Vergleich zu dem dielektrischen Material eine andere Dielektrizitätskonstante aufweist.
  5. Verfahren gemäß einem der vorhergehenden Ansprüche, bei dem die strukturierte Elektrodenschicht (32) eine erste strukturierte Elektrodenschicht (321) ist, wobei eine zweite strukturierte Elektrodenschicht (322) an dem Filmsubstrat (24) angeordnet ist, wobei das dielektrische Material derart auf die zweite strukturierte Elektrodenschicht (322) gedruckt wird, dass das dielektrische Material die zweite strukturierte Elektrodenschicht (322) in einer ersten Region (42) bedeckt und die zweite strukturierte Elektrodenschicht (322) in einer zweiten Region (44) nicht bedeckt, so dass sich eine Materialkante (46) des dielektrischen Materials zwischen der ersten Region (42) und der zweiten Region (44) erstreckt, wobei die erste strukturierte Elektrodenschicht (321) in der ersten Region (42) und in der zweiten Region (44) derart angeordnet ist, dass sich die erste strukturierte Elektrodenschicht (321) über der Materialkante (46) erstreckt und von der zweiten strukturierten Elektrodenschicht (322) in der ersten Region (42) durch das dielektrische Material beabstandet ist und mit der zweiten strukturierten Elektrodenschicht (322) galvanisch verbunden ist oder in einer gemeinsamen Ebene mit der zweiten strukturierten Elektrodenschicht (322) in der zweiten Region (44) angeordnet ist.
  6. Verfahren gemäß Anspruch 5, bei dem die zweite Region (44) von der ersten Region (42) eingeschlossen ist oder an die erste Region (42) angrenzt und eine Kantenregion der ersten Region (42) bildet.
  7. Verfahren gemäß Anspruch 5 oder 6, bei dem die erste strukturierte Elektrodenschicht (321) und die zweite strukturierte Elektrodenschicht (322) derart angeordnet sind, dass die erste strukturierte Elektrodenschicht (321) und die zweite strukturierte Elektrodenschicht (322) in einer gemeinsamen Verbinderschicht verbindbar sind.
  8. Verfahren gemäß einem der Ansprüche 1 bis 4, bei dem die strukturierte Elektrodenschicht (32) eine erste strukturierte Elektrodenschicht (321) ist, wobei das Verfahren ferner folgenden Schritt aufweist:
    Bereitstellen des Filmsubstrats (24) mit zwei gegenüberliegenden Hauptseiten (24a, 24b) und mit der ersten strukturierten Elektrodenschicht (321) auf der ersten Hauptseite (24a) und einer zweiten strukturierten Elektrodenschicht (322) auf der zweiten Hauptseite (24b), so dass das Filmsubstrat (24) eine dielektrische Schicht in Bezug auf die erste und die zweite strukturierte Elektrodenschicht bereitstellt;
    wobei das Drucken (1010) auf der ersten strukturierten Elektrodenschicht (321) durchgeführt wird.
  9. Verfahren gemäß einem der vorhergehenden Ansprüche, bei dem die strukturierte Elektrodenschicht (32) eine erste strukturierte Elektrodenschicht (321) ist, wobei das Filmsubstrat (24) eine zweite strukturierte Elektrodenschicht (322) mit einer Mehrzahl zweiter Leiterbahnen (26) aufweist, wobei das dielektrische Material auf die zweite strukturierte Elektrodenschicht (322) gedruckt wird, wobei die erste strukturierte Elektrodenschicht derart angeordnet ist, dass die erste strukturierte Elektrodenschicht (321) eine Mehrzahl erster Leiterbahnen (261, 262) aufweist, die mit den zweiten Leiterbahnen (263, 264) in einer Mehrzahl überlappender Regionen (48) überlappen, um kapazitive Elemente in den überlappenden Regionen zu bilden.
  10. Verfahren gemäß einem der vorhergehenden Ansprüche, bei dem das Drucken (1010) des dielektrischen Materials als additiver Prozess implementiert wird und eine Ausführung eines Siebdruckprozesses, eines Rotationsdruckprozesses, eines Offsetdruckprozesses, eines Tampondruckprozesses und eines Schleuderbeschichtungsprozesses aufweist.
  11. Verfahren gemäß einem der vorhergehenden Ansprüche, bei dem das dielektrische Material ein lichtempfindliches Material ist, wobei das Verfahren folgenden Schritt aufweist:
    Belichten des lichtempfindlichen Materials in einer Belichtungsregion, um das dielektrische Material in der Belichtungsregion zu entwickeln und um eine Maske des dielektrischen Materials zu definieren.
  12. Verfahren gemäß einem der vorhergehenden Ansprüche, das ferner folgenden Schritt aufweist:
    Anordnen einer elektrischen Abschirmung (62; 621, 622), um die strukturierte Elektrodenschicht (24) abzuschirmen.
  13. PUF-Film (20; 30; 40; 60; 150; 160; 170; 180) mit einem Schichtstapel, wobei der Schichtstapel ein Filmsubstrat (24), eine gedruckte dielektrische Schicht (28) mit einer variierenden Schichtdicke des dielektrischen Materials und eine strukturierte Elektrodenschicht (32) aufweist, die an der dielektrischen Schicht (28) angeordnet ist, wobei die strukturierte Elektrodenschicht (32) in Bezug auf einen elektrischen Messwert aufgrund der variablen Dicke beeinflusst wird.
  14. PUF-Film gemäß Anspruch 13, bei dem die strukturierte Elektrodenschicht (32) eine erste strukturierte Elektrodenschicht (321) ist, wobei zwischen dem Filmsubstrat (24) und dem dielektrischen Material zumindest ein Teil einer zweiten strukturierten Elektrodenschicht (322) angeordnet ist, wobei die dielektrische Schicht (28) derart auf die zweite strukturierte Elektrodenschicht (322) aufgedruckt ist, dass die dielektrische Schicht (28) die zweite strukturierte Elektrodenschicht (322) in einer erster Region (42) bedeckt und die zweite strukturierte Elektrodenschicht in einer zweiten Region (42) nicht bedeckt, wobei sich eine Materialkante (46) des dielektrischen Materials zwischen der ersten Region (42) und der zweiten Region (44) erstreckt, wobei die erste strukturierte Elektrodenschicht (321) in der ersten Region (42) und in der zweiten Region (44) derart angeordnet ist, dass sich die erste strukturierte Elektrodenschicht (321) über der Materialkante (46) erstreckt und von der zweiten strukturierten Elektrodenschicht (322) in der ersten Region durch das dielektrische Material (42) beabstandet ist und mit der zweiten strukturierten Elektrodenschicht (322) in der zweiten Region (44) galvanisch verbunden ist.
  15. PUF-Film gemäß Anspruch 13 oder 14, bei dem die strukturierte Elektrodenschicht (32) eine erste strukturierte Elektrodenschicht (321) ist, wobei das Filmsubstrat (24) eine zweite strukturierte Elektrodenschicht (322) mit einer Mehrzahl zweiter Leiterbahnen (263, 264) aufweist, wobei das dielektrische Material auf die zweite strukturierte Elektrodenschicht (322) gedruckt ist, wobei die erste strukturierte Elektrodenschicht (321) derart angeordnet ist, dass die erste strukturierte Elektrodenschicht (321) eine Mehrzahl erster Leiterbahnen (261, 262) aufweist, die mit den zweiten Leiterbahnen (263, 264) in einer Mehrzahl überlappender Bereiche (48) überlappen, um kapazitive Elemente in den überlappenden Bereichen (48) zu bilden, wobei elektrische Kapazitätswerte der kapazitiven Elemente auf der Basis der Variation der Dicke der dielektrischen Schicht (28) aufgrund des Druckens des dielektrischen Materials stochastisch variieren.
EP18166138.0A 2018-04-06 2018-04-06 Puf-film und verfahren zur herstellung davon Active EP3550623B1 (de)

Priority Applications (3)

Application Number Priority Date Filing Date Title
EP18166138.0A EP3550623B1 (de) 2018-04-06 2018-04-06 Puf-film und verfahren zur herstellung davon
US16/375,081 US11411748B2 (en) 2018-04-06 2019-04-04 PUF-film and method for producing the same
US17/816,315 US11889004B2 (en) 2018-04-06 2022-07-29 PUF-film and method for producing the same

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP18166138.0A EP3550623B1 (de) 2018-04-06 2018-04-06 Puf-film und verfahren zur herstellung davon

Publications (2)

Publication Number Publication Date
EP3550623A1 EP3550623A1 (de) 2019-10-09
EP3550623B1 true EP3550623B1 (de) 2020-07-29

Family

ID=62062799

Family Applications (1)

Application Number Title Priority Date Filing Date
EP18166138.0A Active EP3550623B1 (de) 2018-04-06 2018-04-06 Puf-film und verfahren zur herstellung davon

Country Status (2)

Country Link
US (2) US11411748B2 (de)
EP (1) EP3550623B1 (de)

Family Cites Families (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US3594770A (en) 1968-10-28 1971-07-20 Lewis Eng Co Printed-circuit type security apparatus for protecting areas
US4743275A (en) 1986-08-25 1988-05-10 Flanagan G Patrick Electron field generator
GB8814471D0 (en) 1988-06-17 1988-07-20 Gore & Ass Security enclosure
EP0509567A3 (en) 1991-03-28 1993-04-07 N.V. Philips' Gloeilampenfabrieken Device with protection against access to secure information
GB2270785B (en) 1992-09-22 1996-05-08 Gore & Ass Improvements in security enclosure manufacture
GB2297540B (en) 1993-03-12 1997-01-29 Gore & Ass Tamper respondent enclosure
US5448111A (en) * 1993-09-20 1995-09-05 Fujitsu Limited Semiconductor device and method for fabricating the same
FR2738971B1 (fr) 1995-09-19 1997-10-10 Schlumberger Ind Sa Procede de determination d'une cle de cryptage associee a un circuit integre
US7005733B2 (en) 1999-12-30 2006-02-28 Koemmerling Oliver Anti tamper encapsulation for an integrated circuit
GB2363233B (en) 2000-05-11 2004-03-31 Ibm Tamper resistant card enclosure with improved intrusion detection circuit
GB0012478D0 (en) 2000-05-24 2000-07-12 Ibm Intrusion detection mechanism for cryptographic cards
US6895509B1 (en) 2000-09-21 2005-05-17 Pitney Bowes Inc. Tamper detection system for securing data
US6686539B2 (en) 2001-01-03 2004-02-03 International Business Machines Corporation Tamper-responding encapsulated enclosure having flexible protective mesh structure
US6836843B2 (en) 2001-06-29 2004-12-28 Hewlett-Packard Development Company, L.P. Access control through secure channel using personal identification system
US7065656B2 (en) 2001-07-03 2006-06-20 Hewlett-Packard Development Company, L.P. Tamper-evident/tamper-resistant electronic components
WO2004086202A1 (en) 2003-03-25 2004-10-07 Bourns, Inc. A security housing for a circuit
US8169318B2 (en) 2003-08-29 2012-05-01 Mikoh Corporation Radio frequency identification tag with tamper detection capability
GB2412996B (en) 2004-04-08 2008-11-12 Gore & Ass Tamper respondent covering
JP2006059959A (ja) 2004-08-19 2006-03-02 Oki Electric Ind Co Ltd 半導体装置、及び半導体装置の製造方法
TWI315648B (en) 2004-11-17 2009-10-01 Phoenix Prec Technology Corp Circuit board structure with embeded adjustable passive components and method for fabricating the same
US7281667B2 (en) 2005-04-14 2007-10-16 International Business Machines Corporation Method and structure for implementing secure multichip modules for encryption applications
US7640658B1 (en) 2005-10-18 2010-01-05 Teledyne Technologies Incorporated Methods for forming an anti-tamper pattern
DE102005062802A1 (de) 2005-12-28 2007-07-12 El-Me Ag Elektronik-Sicherheits-Modul
US7760086B2 (en) 2006-11-03 2010-07-20 Gore Enterprise Holdings, Inc Tamper respondent sensor and enclosure
US7787256B2 (en) 2007-08-10 2010-08-31 Gore Enterprise Holdings, Inc. Tamper respondent system
KR101724075B1 (ko) * 2008-04-18 2017-04-06 메사추세츠 인스티튜트 오브 테크놀로지 불규칙한 표면의 웨지 임프린트 패터닝
CN102265395B (zh) * 2008-12-29 2013-10-16 Nxp股份有限公司 用于物理不可复制功能的物理结构
EP2230794A3 (de) * 2009-03-16 2011-10-05 Technische Universität München Auf dem Weg zu elektrischen, integrierten Implementierungen von SIMPL Systemen
US8576182B2 (en) 2009-09-01 2013-11-05 Atmel Corporation Methods and apparatuses to test the functionality of capacitive sensors
US9331012B2 (en) 2012-03-08 2016-05-03 International Business Machines Corporation Method for fabricating a physical unclonable interconnect function array
EP2665094A1 (de) 2012-05-15 2013-11-20 Nxp B.V. Manipulationssichere IC
GB2504480A (en) 2012-07-27 2014-02-05 Johnson Electric Sa Multilayer Security Wrap Film for Protecting Electronic Device.
US8525169B1 (en) 2012-08-10 2013-09-03 International Business Machines Corporation Reliable physical unclonable function for device authentication
DE102013205729A1 (de) 2013-03-28 2014-10-02 Fraunhofer-Gesellschaft zur Förderung der angewandten Forschung e.V. Vorrichtung und Verfahren mit einem Träger mit Schaltungsstrukturen
EP2819049B1 (de) 2013-06-27 2015-11-18 Nxp B.V. Vorrichtung mit kapazitivem Sicherheitsschild
US9224030B2 (en) 2014-01-10 2015-12-29 Qualcomm Incorporated Sensor identification
US9501664B1 (en) 2014-12-15 2016-11-22 Sandia Corporation Method, apparatus and system to compensate for drift by physically unclonable function circuitry
US9660806B2 (en) 2014-12-30 2017-05-23 International Business Machines Corporation Carbon nanotube array for cryptographic key generation and protection
US9846187B2 (en) 2015-05-11 2017-12-19 Winbond Electronics Corporation Snooping detection between silicon elements in a circuit
FR3041454B1 (fr) 2015-09-22 2018-03-16 Thales Dispositif de protection d'un circuit electronique avec detection d'un changement de reactance electrique
JP2017092885A (ja) 2015-11-17 2017-05-25 ソニー株式会社 信号処理回路および方法
EP3193281B1 (de) 2016-01-15 2019-11-13 Nxp B.V. Elektronische vorrichtung
FR3054344B1 (fr) 2016-07-25 2018-09-07 Tiempo Circuit integre protege.
WO2018106509A1 (en) 2016-12-05 2018-06-14 Cryptography Research Inc. Backside security shield
US10706177B2 (en) 2017-02-13 2020-07-07 Hiroshi Watanabe Apparatus and method for chip identification and preventing malicious manipulation of physical addresses by incorporating a physical network with a logical network
US10819528B2 (en) 2017-07-18 2020-10-27 Square, Inc. Device security with physically unclonable functions
US10056905B1 (en) 2017-07-28 2018-08-21 Bae Systems Information And Electronic Systems Integration Inc. Nanomaterial-based physically unclonable function device
EP3492866B1 (de) * 2017-12-01 2021-12-01 Airbus Operations, S.L. Herstellungsverfahren eines positionierungssteuerungswerkzeugs über 3d-drucktechnologie

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
US20190312739A1 (en) 2019-10-10
US11889004B2 (en) 2024-01-30
EP3550623A1 (de) 2019-10-09
US20220384368A1 (en) 2022-12-01
US11411748B2 (en) 2022-08-09

Similar Documents

Publication Publication Date Title
US11586780B2 (en) PUF-film and method for producing the same
Immler et al. B-TREPID: Batteryless tamper-resistant envelope with a PUF and integrity detection
Immler et al. Secure physical enclosures from covers with tamper-resistance
US11301593B2 (en) PUF-film and method for producing the same
Merli et al. Semi-invasive EM attack on FPGA RO PUFs and countermeasures
Wei et al. BoardPUF: Physical unclonable functions for printed circuit board authentication
US20160092680A1 (en) Apparatus and method comprising a carrier with circuit structures
Obermaier et al. A measurement system for capacitive PUF-based security enclosures
Strobel et al. Microcontrollers as (in) security devices for pervasive computing applications
JP6905473B2 (ja) 物理的及び／又は電気的変化に対する集積回路チップ保護
Harrison et al. On malicious implants in PCBs throughout the supply chain
Nagata et al. Physical attack protection techniques for IC chip level hardware security
Obermaier et al. The past, present, and future of physical security enclosures: from battery-backed monitoring to puf-based inherent security and beyond
US11276648B2 (en) Protecting chips from electromagnetic pulse attacks using an antenna
Yang et al. An RFID-based technology for electronic component and system counterfeit detection and traceability
Mosavirik et al. Impedanceverif: On-chip impedance sensing for system-level tampering detection
US11889004B2 (en) PUF-film and method for producing the same
Zhu et al. PDNPulse: Sensing PCB anomaly with the intrinsic power delivery network
US20220271953A1 (en) Chip Device and Method for a Randomized Logic Encryption
Nishizawa et al. Capacitance measurement of running hardware devices and its application to malicious modification detection
Nagata et al. On-chip physical attack protection circuits for hardware security
Kumar et al. DevFing: Robust LCR based device fingerprinting
Garb et al. Attacks and countermeasures for capacitive puf-based security enclosures
Vaidya et al. Sensor Identification via Acoustic Physically Unclonable Function
Shen et al. Coating-based pcb protection against tampering, snooping, em attack, and x-ray reverse engineering

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20190320

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

INTG Intention to grant announced

Effective date: 20200210

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1296831

Country of ref document: AT

Kind code of ref document: T

Effective date: 20200815

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602018006344

Country of ref document: DE

REG Reference to a national code

Ref country code: NL

Ref legal event code: FP

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1296831

Country of ref document: AT

Kind code of ref document: T

Effective date: 20200729

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20201029

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20201130

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20201030

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20201029

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20201129

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602018006344

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

26N No opposition filed

Effective date: 20210430

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210406

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20210430

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210430

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210430

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20201129

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210430

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602018006344

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H01L0049020000

Ipc: H10N0097000000

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20220406

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220406

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230524

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: NL

Payment date: 20230417

Year of fee payment: 6

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20180406

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230417

Year of fee payment: 6

Ref country code: DE

Payment date: 20230418

Year of fee payment: 6